diff --git a/src/dotnet/APIView/APIViewUnitTests/PermissionsControllerTests.cs b/src/dotnet/APIView/APIViewUnitTests/PermissionsControllerTests.cs
new file mode 100644
index 00000000000..66932f21d44
--- /dev/null
+++ b/src/dotnet/APIView/APIViewUnitTests/PermissionsControllerTests.cs
@@ -0,0 +1,439 @@
+using System;
+using System.Collections.Generic;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using APIView.Identity;
+using APIViewWeb.Helpers;
+using APIViewWeb.LeanControllers;
+using APIViewWeb.LeanModels;
+using APIViewWeb.Managers.Interfaces;
+using FluentAssertions;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Moq;
+using Xunit;
+
+namespace APIViewUnitTests;
+
+public class PermissionsControllerTests
+{
+    private readonly Mock<IPermissionsManager> _mockPermissionsManager;
+    private readonly PermissionsController _controller;
+
+    public PermissionsControllerTests()
+    {
+        _mockPermissionsManager = new Mock<IPermissionsManager>();
+
+        _controller = new PermissionsController(_mockPermissionsManager.Object);
+
+        var user = new ClaimsPrincipal(new ClaimsIdentity(new Claim[]
+        {
+            new(ClaimConstants.Login, "testuser"),
+            new(ClaimTypes.Name, "Test User")
+        }, "mock"));
+
+        _controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = user }
+        };
+    }
+
+    private void SetupAdminUser()
+    {
+        _mockPermissionsManager.Setup(m => m.IsAdminAsync("testuser")).ReturnsAsync(true);
+    }
+
+    private void SetupNonAdminUser()
+    {
+        _mockPermissionsManager.Setup(m => m.IsAdminAsync("testuser")).ReturnsAsync(false);
+    }
+
+    #region GetMyPermissions Tests
+
+    [Fact]
+    public async Task GetMyPermissions_ReturnsUserPermissions()
+    {
+        var expectedPermissions = new EffectivePermissions
+        {
+            UserId = "testuser",
+            Roles = new List<RoleAssignment>
+            {
+                new GlobalRoleAssignment { Role = GlobalRole.SdkTeam }
+            }
+        };
+
+        _mockPermissionsManager.Setup(m => m.GetEffectivePermissionsAsync("testuser"))
+            .ReturnsAsync(expectedPermissions);
+
+        var result = await _controller.GetMyPermissions();
+        result.Should().NotBeNull();
+        result.Result.Should().BeOfType<LeanJsonResult>();
+    }
+
+    #endregion
+
+    #region GetAllGroups Tests
+
+    [Fact]
+    public async Task GetAllGroups_WhenAdmin_ReturnsGroups()
+    {
+        SetupAdminUser();
+
+        var groups = new List<GroupPermissionsModel>
+        {
+            new() { GroupId = "group1", GroupName = "Group 1" },
+            new() { GroupId = "group2", GroupName = "Group 2" }
+        };
+        _mockPermissionsManager.Setup(m => m.GetAllGroupsAsync()).ReturnsAsync(groups);
+
+        var result = await _controller.GetAllGroups();
+        result.Should().BeOfType<LeanJsonResult>();
+    }
+
+    [Fact]
+    public async Task GetAllGroups_WhenNotAdmin_ReturnsForbid()
+    {
+        SetupNonAdminUser();
+
+        var result = await _controller.GetAllGroups();
+        result.Should().BeOfType<ForbidResult>();
+    }
+
+    #endregion
+
+    #region GetGroup Tests
+
+    [Fact]
+    public async Task GetGroup_WhenAdminAndGroupExists_ReturnsGroup()
+    {
+        SetupAdminUser();
+
+        var group = new GroupPermissionsModel { GroupId = "test-group", GroupName = "Test Group" };
+        _mockPermissionsManager.Setup(m => m.GetGroupAsync("test-group")).ReturnsAsync(group);
+
+        var result = await _controller.GetGroup("test-group");
+        result.Result.Should().BeOfType<LeanJsonResult>();
+    }
+
+    [Fact]
+    public async Task GetGroup_WhenAdminAndGroupNotFound_ReturnsNotFound()
+    {
+        SetupAdminUser();
+        _mockPermissionsManager.Setup(m => m.GetGroupAsync("invalid")).ReturnsAsync((GroupPermissionsModel)null);
+
+        var result = await _controller.GetGroup("invalid");
+        result.Result.Should().BeOfType<NotFoundObjectResult>();
+    }
+
+    [Fact]
+    public async Task GetGroup_WhenNotAdmin_ReturnsForbid()
+    {
+        SetupNonAdminUser();
+
+        var result = await _controller.GetGroup("test-group");
+        result.Result.Should().BeOfType<ForbidResult>();
+    }
+
+    #endregion
+
+    #region CreateGroup Tests
+
+    [Fact]
+    public async Task CreateGroup_WhenAdminWithValidRequest_ReturnsCreatedGroup()
+    {
+        SetupAdminUser();
+
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "new-group",
+            GroupName = "New Group",
+            Roles = new List<RoleAssignment>()
+        };
+
+        var createdGroup = new GroupPermissionsModel
+        {
+            GroupId = "new-group",
+            GroupName = "New Group"
+        };
+
+        _mockPermissionsManager.Setup(m => m.GetGroupAsync("new-group")).ReturnsAsync((GroupPermissionsModel)null);
+        _mockPermissionsManager.Setup(m => m.CreateGroupAsync(request, "testuser")).ReturnsAsync(createdGroup);
+
+        var result = await _controller.CreateGroup(request);
+        result.Result.Should().BeOfType<LeanJsonResult>();
+        _mockPermissionsManager.Verify(m => m.CreateGroupAsync(request, "testuser"), Times.Once);
+    }
+
+    [Fact]
+    public async Task CreateGroup_WhenNotAdmin_ReturnsForbid()
+    {
+
+        SetupNonAdminUser();
+
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "new-group",
+            GroupName = "New Group"
+        };
+
+        var result = await _controller.CreateGroup(request);
+        result.Result.Should().BeOfType<ForbidResult>();
+    }
+
+    [Fact]
+    public async Task CreateGroup_WithMissingGroupId_ReturnsBadRequest()
+    {
+
+        SetupAdminUser();
+
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "",
+            GroupName = "New Group"
+        };
+
+        var result = await _controller.CreateGroup(request);
+        result.Result.Should().BeOfType<BadRequestObjectResult>();
+    }
+
+    [Fact]
+    public async Task CreateGroup_WithMissingGroupName_ReturnsBadRequest()
+    {
+
+        SetupAdminUser();
+
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "new-group",
+            GroupName = ""
+        };
+
+        var result = await _controller.CreateGroup(request);
+        result.Result.Should().BeOfType<BadRequestObjectResult>();
+    }
+
+    [Fact]
+    public async Task CreateGroup_WithExistingGroupId_ReturnsConflict()
+    {
+        SetupAdminUser();
+
+        var existingGroup = new GroupPermissionsModel { GroupId = "existing-group" };
+        _mockPermissionsManager.Setup(m => m.GetGroupAsync("existing-group")).ReturnsAsync(existingGroup);
+
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "existing-group",
+            GroupName = "Existing Group"
+        };
+
+        var result = await _controller.CreateGroup(request);
+        result.Result.Should().BeOfType<ConflictObjectResult>();
+    }
+
+    #endregion
+
+    #region UpdateGroup Tests
+
+    [Fact]
+    public async Task UpdateGroup_WhenAdminWithValidRequest_ReturnsUpdatedGroup()
+    {
+        SetupAdminUser();
+
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "test-group",
+            GroupName = "Updated Group"
+        };
+
+        var updatedGroup = new GroupPermissionsModel
+        {
+            GroupId = "test-group",
+            GroupName = "Updated Group"
+        };
+
+        _mockPermissionsManager.Setup(m => m.UpdateGroupAsync("test-group", request, "testuser"))
+            .ReturnsAsync(updatedGroup);
+
+        var result = await _controller.UpdateGroup("test-group", request);
+        result.Result.Should().BeOfType<LeanJsonResult>();
+    }
+
+    [Fact]
+    public async Task UpdateGroup_WhenNotAdmin_ReturnsForbid()
+    {
+        SetupNonAdminUser();
+
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "test-group",
+            GroupName = "Updated Group"
+        };
+
+        var result = await _controller.UpdateGroup("test-group", request);
+        result.Result.Should().BeOfType<ForbidResult>();
+    }
+
+    [Fact]
+    public async Task UpdateGroup_WhenGroupNotFound_ReturnsNotFound()
+    {
+        SetupAdminUser();
+
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "invalid",
+            GroupName = "Updated Group"
+        };
+
+        _mockPermissionsManager.Setup(m => m.UpdateGroupAsync("invalid", request, "testuser"))
+            .ThrowsAsync(new ArgumentException("Group not found"));
+
+        var result = await _controller.UpdateGroup("invalid", request);
+        result.Result.Should().BeOfType<NotFoundObjectResult>();
+    }
+
+    #endregion
+
+    #region DeleteGroup Tests
+
+    [Fact]
+    public async Task DeleteGroup_WhenAdmin_ReturnsNoContent()
+    {
+        SetupAdminUser();
+        _mockPermissionsManager.Setup(m => m.DeleteGroupAsync("test-group")).Returns(Task.CompletedTask);
+
+        var result = await _controller.DeleteGroup("test-group");
+        result.Should().BeOfType<NoContentResult>();
+    }
+
+    [Fact]
+    public async Task DeleteGroup_WhenNotAdmin_ReturnsForbid()
+    {
+        SetupNonAdminUser();
+
+        var result = await _controller.DeleteGroup("test-group");
+        result.Should().BeOfType<ForbidResult>();
+    }
+
+    #endregion
+
+    #region AddMembers Tests
+
+    [Fact]
+    public async Task AddMembers_WhenAdminWithValidRequest_ReturnsOk()
+    {
+        SetupAdminUser();
+
+        var request = new AddMembersRequest { UserIds = new List<string> { "user1", "user2" } };
+
+        var addMembersResult = new AddMembersResult
+        {
+            AddedUsers = new List<string> { "user1", "user2" },
+            InvalidUsers = new List<string>()
+        };
+
+        _mockPermissionsManager.Setup(m => m.AddMembersToGroupAsync("test-group", It.IsAny<IEnumerable<string>>(), "testuser"))
+            .ReturnsAsync(addMembersResult);
+
+        var result = await _controller.AddMembers("test-group", request);
+        result.Result.Should().BeOfType<LeanJsonResult>();
+    }
+
+    [Fact]
+    public async Task AddMembers_WhenNotAdmin_ReturnsForbid()
+    {
+        SetupNonAdminUser();
+
+        var request = new AddMembersRequest { UserIds = new List<string> { "user1" } };
+
+        var result = await _controller.AddMembers("test-group", request);
+        result.Result.Should().BeOfType<ForbidResult>();
+    }
+
+    [Fact]
+    public async Task AddMembers_WithEmptyUserIds_ReturnsBadRequest()
+    {
+        SetupAdminUser();
+
+        var request = new AddMembersRequest { UserIds = new List<string>() };
+
+        var result = await _controller.AddMembers("test-group", request);
+        result.Result.Should().BeOfType<BadRequestObjectResult>();
+    }
+
+    [Fact]
+    public async Task AddMembers_WithNullUserIds_ReturnsBadRequest()
+    {
+        SetupAdminUser();
+
+        var request = new AddMembersRequest { UserIds = null };
+
+        var result = await _controller.AddMembers("test-group", request);
+        result.Result.Should().BeOfType<BadRequestObjectResult>();
+    }
+
+    [Fact]
+    public async Task AddMembers_WhenGroupNotFound_ReturnsNotFound()
+    {
+        SetupAdminUser();
+
+        var request = new AddMembersRequest { UserIds = new List<string> { "user1" } };
+
+        _mockPermissionsManager.Setup(m => m.AddMembersToGroupAsync("invalid", request.UserIds, "testuser"))
+            .ThrowsAsync(new ArgumentException("Group not found"));
+
+        var result = await _controller.AddMembers("invalid", request);
+        result.Result.Should().BeOfType<NotFoundObjectResult>();
+    }
+
+    #endregion
+
+    #region RemoveMember Tests
+
+    [Fact]
+    public async Task RemoveMember_WhenAdmin_ReturnsNoContent()
+    {
+        SetupAdminUser();
+        _mockPermissionsManager.Setup(m => m.RemoveMemberFromGroupAsync("test-group", "user1", "testuser"))
+            .Returns(Task.CompletedTask);
+
+        var result = await _controller.RemoveMember("test-group", "user1");
+        result.Should().BeOfType<NoContentResult>();
+    }
+
+    [Fact]
+    public async Task RemoveMember_WhenNotAdmin_ReturnsForbid()
+    {
+        SetupNonAdminUser();
+
+        var result = await _controller.RemoveMember("test-group", "user1");
+        result.Should().BeOfType<ForbidResult>();
+    }
+
+    #endregion
+
+    #region GetAllUsernames Tests
+
+    [Fact]
+    public async Task GetAllUsernames_WhenAdmin_ReturnsUsers()
+    {
+        SetupAdminUser();
+        var expectedUsers = new List<string> { "user1", "user2" };
+        _mockPermissionsManager.Setup(m => m.GetAllUsernamesAsync())
+            .ReturnsAsync(expectedUsers);
+
+        var result = await _controller.GetAllUsernames();
+        result.Should().NotBeNull();
+        result.Result.Should().BeOfType<LeanJsonResult>();
+    }
+
+    [Fact]
+    public async Task GetAllUsernames_WhenNotAdmin_ReturnsForbid()
+    {
+        SetupNonAdminUser();
+
+        var result = await _controller.GetAllUsernames();
+        result.Result.Should().BeOfType<ForbidResult>();
+    }
+
+    #endregion
+}
diff --git a/src/dotnet/APIView/APIViewUnitTests/PermissionsManagerTests.cs b/src/dotnet/APIView/APIViewUnitTests/PermissionsManagerTests.cs
new file mode 100644
index 00000000000..b1bd8dd0f60
--- /dev/null
+++ b/src/dotnet/APIView/APIViewUnitTests/PermissionsManagerTests.cs
@@ -0,0 +1,470 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using APIViewWeb.LeanModels;
+using APIViewWeb.Managers;
+using APIViewWeb.Repositories;
+using FluentAssertions;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging;
+using Microsoft.TeamFoundation.WorkItemTracking.Process.WebApi.Models;
+using Moq;
+using Xunit;
+
+namespace APIViewUnitTests;
+
+public class PermissionsManagerTests
+{
+    private readonly Mock<ICosmosPermissionsRepository> _mockRepository;
+    private readonly Mock<ICosmosUserProfileRepository> _mockUserProfileRepository;
+    private readonly Mock<IMemoryCache> _mockCache;
+    private readonly Mock<ILogger<PermissionsManager>> _mockLogger;
+    private readonly PermissionsManager _manager;
+
+    public PermissionsManagerTests()
+    {
+        _mockRepository = new Mock<ICosmosPermissionsRepository>();
+        _mockUserProfileRepository = new Mock<ICosmosUserProfileRepository>();
+        _mockCache = new Mock<IMemoryCache>();
+        _mockLogger = new Mock<ILogger<PermissionsManager>>();
+
+        // Setup cache to return false for TryGetValue (cache miss by default)
+        object outValue;
+        _mockCache.Setup(c => c.TryGetValue(It.IsAny<object>(), out outValue)).Returns(false);
+        _mockCache.Setup(c => c.CreateEntry(It.IsAny<object>())).Returns(Mock.Of<ICacheEntry>());
+
+        _manager = new PermissionsManager(
+            _mockRepository.Object,
+            _mockUserProfileRepository.Object,
+            _mockCache.Object,
+            _mockLogger.Object
+        );
+    }
+
+    #region GetEffectivePermissionsAsync Tests
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task GetEffectivePermissionsAsync_WithNullOrEmptyUserId_ReturnsEmptyPermissions(string userId)
+    {
+        EffectivePermissions result = await _manager.GetEffectivePermissionsAsync(userId);
+        result.Should().NotBeNull();
+        result.UserId.Should().Be(userId);
+        result.Roles.Should().BeEmpty();
+    }
+
+    [Fact]
+    public async Task GetEffectivePermissionsAsync_WithUserInNoGroups_ReturnsEmptyRoles()
+    {
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("testuser"))
+            .ReturnsAsync(new List<GroupPermissionsModel>());
+
+        EffectivePermissions result = await _manager.GetEffectivePermissionsAsync("testuser");
+        result.Should().NotBeNull();
+        result.UserId.Should().Be("testuser");
+        result.Roles.Count.Should().Be(1);
+        result.Roles.First().Should().BeOfType<GlobalRoleAssignment>();
+        ((GlobalRoleAssignment)result.Roles.First()).Role.Should().Be(GlobalRole.SdkTeam);
+
+    }
+
+    [Fact]
+    public async Task GetEffectivePermissionsAsync_WithUserInGroupWithGlobalRole_ReturnsMergedRoles()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "admin-group",
+                GroupName = "Admin Group",
+                Members = new List<string> { "testuser" },
+                Roles = new List<RoleAssignment> { new GlobalRoleAssignment { Role = GlobalRole.Admin } }
+            }
+        };
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("testuser"))
+            .ReturnsAsync(groups);
+
+
+        EffectivePermissions result = await _manager.GetEffectivePermissionsAsync("testuser");
+        result.Should().NotBeNull();
+        result.Roles.Should().HaveCount(1);
+        result.Roles.First().Should().BeOfType<GlobalRoleAssignment>();
+        ((GlobalRoleAssignment)result.Roles.First()).Role.Should().Be(GlobalRole.Admin);
+    }
+
+    [Fact]
+    public async Task GetEffectivePermissionsAsync_WithUserInGroupWithScopedRole_ReturnsScopedRoles()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "csharp-architects",
+                GroupName = "C# Architects",
+                Members = new List<string> { "testuser" },
+                Roles = new List<RoleAssignment>
+                {
+                    new LanguageScopedRoleAssignment
+                    {
+                        Role = LanguageScopedRole.Architect, Language = "CSharp"
+                    }
+                }
+            }
+        };
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("testuser"))
+            .ReturnsAsync(groups);
+
+
+        EffectivePermissions result = await _manager.GetEffectivePermissionsAsync("testuser");
+        result.Should().NotBeNull();
+        result.Roles.Should().HaveCount(1);
+        var scopedRole = result.Roles.First().Should().BeOfType<LanguageScopedRoleAssignment>().Subject;
+        scopedRole.Role.Should().Be(LanguageScopedRole.Architect);
+        scopedRole.Language.Should().Be("CSharp");
+    }
+
+    [Fact]
+    public async Task GetEffectivePermissionsAsync_WithUserInMultipleGroups_MergesAllRoles()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "sdk-team",
+                GroupName = "SDK Team",
+                Members = new List<string> { "testuser" },
+                Roles = new List<RoleAssignment> { new GlobalRoleAssignment { Role = GlobalRole.SdkTeam } }
+            },
+            new()
+            {
+                GroupId = "csharp-architects",
+                GroupName = "C# Architects",
+                Members = new List<string> { "testuser" },
+                Roles = new List<RoleAssignment>
+                {
+                    new LanguageScopedRoleAssignment
+                    {
+                        Role = LanguageScopedRole.Architect, Language = "CSharp"
+                    }
+                }
+            }
+        };
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("testuser"))
+            .ReturnsAsync(groups);
+
+
+        EffectivePermissions result = await _manager.GetEffectivePermissionsAsync("testuser");
+        result.Should().NotBeNull();
+        result.Roles.Should().HaveCount(2);
+        result.Roles.Should().ContainSingle(r => r is GlobalRoleAssignment);
+        result.Roles.Should().ContainSingle(r => r is LanguageScopedRoleAssignment);
+    }
+
+    [Fact]
+    public async Task GetEffectivePermissionsAsync_CachesResult()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "admin-group",
+                Roles = new List<RoleAssignment> { new GlobalRoleAssignment { Role = GlobalRole.Admin } }
+            }
+        };
+
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("testuser"))
+            .ReturnsAsync(groups);
+
+        await _manager.GetEffectivePermissionsAsync("testuser");
+        _mockCache.Verify(c => c.CreateEntry(It.Is<object>(k => k.ToString().Contains("testuser"))), Times.Once);
+    }
+
+    #endregion
+
+    #region Group CRUD Tests
+
+    [Fact]
+    public async Task GetAllGroupsAsync_ReturnsAllGroups()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new() { GroupId = "group1", GroupName = "Group 1" }, new() { GroupId = "group2", GroupName = "Group 2" }
+        };
+
+        _mockRepository.Setup(r => r.GetAllGroupsAsync()).ReturnsAsync(groups);
+
+        IEnumerable<GroupPermissionsModel> result = await _manager.GetAllGroupsAsync();
+        result.Should().HaveCount(2);
+    }
+
+    [Fact]
+    public async Task GetGroupAsync_WithValidId_ReturnsGroup()
+    {
+        var group = new GroupPermissionsModel { GroupId = "test-group", GroupName = "Test Group" };
+        _mockRepository.Setup(r => r.GetGroupAsync("test-group")).ReturnsAsync(group);
+
+        GroupPermissionsModel result = await _manager.GetGroupAsync("test-group");
+        result.Should().NotBeNull();
+        result.GroupId.Should().Be("test-group");
+    }
+
+    [Fact]
+    public async Task GetGroupAsync_WithInvalidId_ReturnsNull()
+    {
+        _mockRepository.Setup(r => r.GetGroupAsync("invalid")).ReturnsAsync((GroupPermissionsModel)null);
+        GroupPermissionsModel result = await _manager.GetGroupAsync("invalid");
+        result.Should().BeNull();
+    }
+
+    [Fact]
+    public async Task CreateGroupAsync_CreatesNewGroup()
+    {
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "new-group",
+            GroupName = "New Group",
+            Roles = new List<RoleAssignment> { new GlobalRoleAssignment { Role = GlobalRole.SdkTeam } }
+        };
+        _mockRepository.Setup(r => r.UpsertGroupAsync(It.IsAny<GroupPermissionsModel>()))
+            .Returns(Task.CompletedTask);
+
+        GroupPermissionsModel result = await _manager.CreateGroupAsync(request, "admin");
+        result.Should().NotBeNull();
+        result.GroupId.Should().Be("new-group");
+        result.GroupName.Should().Be("New Group");
+        result.LastUpdatedBy.Should().Be("admin");
+        result.Members.Should().BeEmpty();
+        result.Roles.Should().HaveCount(1);
+
+        _mockRepository.Verify(r => r.UpsertGroupAsync(
+            It.Is<GroupPermissionsModel>(g => g.GroupId == "new-group" && g.GroupName == "New Group"
+            )), Times.Once);
+    }
+
+    [Fact]
+    public async Task UpdateGroupAsync_WithValidId_UpdatesGroup()
+    {
+        var existingGroup = new GroupPermissionsModel
+        {
+            GroupId = "test-group",
+            GroupName = "Old Name",
+            Members = new List<string> { "user1" },
+            Roles = new List<RoleAssignment>()
+        };
+        _mockRepository.Setup(r => r.GetGroupAsync("test-group")).ReturnsAsync(existingGroup);
+        _mockRepository.Setup(r => r.UpsertGroupAsync(It.IsAny<GroupPermissionsModel>()))
+            .Returns(Task.CompletedTask);
+
+        var request = new GroupPermissionsRequest
+        {
+            GroupId = "test-group",
+            GroupName = "New Name",
+            Roles = new List<RoleAssignment> { new GlobalRoleAssignment { Role = GlobalRole.Admin } }
+        };
+
+        GroupPermissionsModel result = await _manager.UpdateGroupAsync("test-group", request, "admin");
+        result.Should().NotBeNull();
+        result.GroupName.Should().Be("New Name");
+        result.LastUpdatedBy.Should().Be("admin");
+    }
+
+    [Fact]
+    public async Task DeleteGroupAsync_CallsRepository()
+    {
+        var group = new GroupPermissionsModel { GroupId = "test-group", Members = ["user1"] };
+        _mockRepository.Setup(r => r.GetGroupAsync("test-group")).ReturnsAsync(group);
+        _mockRepository.Setup(r => r.DeleteGroupAsync("test-group")).Returns(Task.CompletedTask);
+
+
+        await _manager.DeleteGroupAsync("test-group");
+        _mockRepository.Verify(r => r.DeleteGroupAsync("test-group"), Times.Once);
+    }
+
+    #endregion
+
+    #region Member Management Tests
+
+    [Fact]
+    public async Task AddMembersToGroupAsync_CallsRepository()
+    {
+        var userIds = new List<string> { "user1", "user2" };
+        _mockRepository.Setup(r => r.AddMembersToGroupAsync("test-group", userIds))
+            .Returns(Task.CompletedTask);
+        _mockUserProfileRepository.Setup(r => r.GetExistingUsersAsync(It.IsAny<IEnumerable<string>>()))
+            .ReturnsAsync(userIds);
+
+        await _manager.AddMembersToGroupAsync("test-group", userIds, "admin");
+        _mockRepository.Verify(r => r.AddMembersToGroupAsync("test-group", userIds), Times.Once);
+    }
+
+    [Fact]
+    public async Task RemoveMemberFromGroupAsync_CallsRepository()
+    {
+        _mockRepository.Setup(r => r.RemoveMemberFromGroupAsync("test-group", "user1"))
+            .Returns(Task.CompletedTask);
+        await _manager.RemoveMemberFromGroupAsync("test-group", "user1", "admin");
+
+        _mockRepository.Verify(r => r.RemoveMemberFromGroupAsync("test-group", "user1"), Times.Once);
+    }
+
+    #endregion
+
+    #region IsAdminAsync Tests
+
+    [Fact]
+    public async Task IsAdminAsync_WithAdminUser_ReturnsTrue()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "admin-group",
+                Roles = new List<RoleAssignment> { new GlobalRoleAssignment { Role = GlobalRole.Admin } }
+            }
+        };
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("admin")).ReturnsAsync(groups);
+
+        bool result = await _manager.IsAdminAsync("admin");
+        result.Should().BeTrue();
+    }
+
+    [Fact]
+    public async Task IsAdminAsync_WithNonAdminUser_ReturnsFalse()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "sdk-team",
+                Roles = new List<RoleAssignment> { new GlobalRoleAssignment { Role = GlobalRole.SdkTeam } }
+            }
+        };
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("user")).ReturnsAsync(groups);
+
+        bool result = await _manager.IsAdminAsync("user");
+        result.Should().BeFalse();
+    }
+
+    [Fact]
+    public async Task IsAdminAsync_WithUserInNoGroups_ReturnsFalse()
+    {
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("user"))
+            .ReturnsAsync(new List<GroupPermissionsModel>());
+
+        bool result = await _manager.IsAdminAsync("user");
+        result.Should().BeFalse();
+    }
+
+    #endregion
+
+    #region CanApproveForLanguageAsync Tests
+
+    [Fact]
+    public async Task CanApproveForLanguageAsync_WithArchitectRole_ReturnsTrue()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "csharp-architects",
+                Roles = new List<RoleAssignment>
+                {
+                    new LanguageScopedRoleAssignment
+                    {
+                        Role = LanguageScopedRole.Architect, Language = "CSharp"
+                    }
+                }
+            }
+        };
+
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("user")).ReturnsAsync(groups);
+
+        bool result = await _manager.CanApproveAsync("user", "CSharp");
+        result.Should().BeTrue();
+    }
+
+    [Fact]
+    public async Task CanApproveForLanguageAsync_WithDeputyArchitectRole_ReturnsTrue()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "python-deputies",
+                Roles =
+                [
+                    new LanguageScopedRoleAssignment { Role = LanguageScopedRole.DeputyArchitect, Language = "Python" }
+                ]
+            }
+        };
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("user")).ReturnsAsync(groups);
+
+        var result = await _manager.CanApproveAsync("user", "Python");
+        result.Should().BeTrue();
+    }
+
+    [Fact]
+    public async Task CanApproveForLanguageAsync_WithDifferentLanguage_ReturnsFalse()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "csharp-architects",
+                Roles = new List<RoleAssignment>
+                {
+                    new LanguageScopedRoleAssignment
+                    {
+                        Role = LanguageScopedRole.Architect, Language = "CSharp"
+                    }
+                }
+            }
+        };
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("user")).ReturnsAsync(groups);
+
+        bool result = await _manager.CanApproveAsync("user", "Python");
+        result.Should().BeFalse();
+    }
+
+    [Fact]
+    public async Task CanApproveForLanguageAsync_ForAdmin_ReturnsTrue()
+    {
+        var groups = new List<GroupPermissionsModel>
+        {
+            new()
+            {
+                GroupId = "admin-group",
+                Roles = new List<RoleAssignment> { new GlobalRoleAssignment { Role = GlobalRole.Admin } }
+            }
+        };
+        _mockRepository.Setup(r => r.GetGroupsForUserAsync("user")).ReturnsAsync(groups);
+
+        bool result = await _manager.CanApproveAsync("user", "CSharp");
+        result.Should().BeTrue();
+    }
+
+    #endregion
+
+    #region GetAllUsernamesAsync Tests
+
+    [Fact]
+    public async Task GetAllUsernamesAsync_CallsUserProfileRepository()
+    {
+        var expectedUsers = new List<string> { "user1", "user2", "user3" };
+        _mockUserProfileRepository.Setup(r => r.GetAllUsernamesAsync())
+            .ReturnsAsync(expectedUsers);
+
+        var result = await _manager.GetAllUsernamesAsync();
+
+        result.Should().BeEquivalentTo(expectedUsers);
+        _mockUserProfileRepository.Verify(r => r.GetAllUsernamesAsync(), Times.Once);
+    }
+
+    #endregion
+}
diff --git a/src/dotnet/APIView/APIViewWeb/Client/src/shared/layout.ts b/src/dotnet/APIView/APIViewWeb/Client/src/shared/layout.ts
index 739931840be..70573cf93a1 100644
--- a/src/dotnet/APIView/APIViewWeb/Client/src/shared/layout.ts
+++ b/src/dotnet/APIView/APIViewWeb/Client/src/shared/layout.ts
@@ -8,6 +8,38 @@ document.addEventListener('DOMContentLoaded', () => {
     document.querySelectorAll('[data-bs-toggle="popover"]')
         .forEach(el => new bootstrap.Popover(el));
 
+    // Check if user is admin and show admin settings link
+    const adminSettingsItem = document.querySelector('.admin-settings-item');
+    if (adminSettingsItem) {
+        fetch('/api/Permissions/me', { credentials: 'include' })
+            .then(response => {
+                if (response.ok) {
+                    return response.json();
+                }
+                throw new Error('Failed to fetch permissions');
+            })
+            .then(permissions => {
+                const isAdmin = permissions?.roles?.some(
+                    (role: { kind: string; role: string }) => role.kind === 'global' && role.role.toLowerCase() === 'admin'
+                );
+                if (isAdmin) {
+                    adminSettingsItem.classList.remove('d-none');
+                    const adminLink = adminSettingsItem.querySelector('a');
+                    if (adminLink) {
+                        const host = window.location.hostname;
+                        let spaBaseUrl: string;
+                        if (host === 'localhost' || host === '127.0.0.1') {
+                            spaBaseUrl = 'https://localhost:4200';
+                        } else {
+                            spaBaseUrl = `${window.location.protocol}//spa.${host}`;
+                        }
+                        adminLink.setAttribute('href', `${spaBaseUrl}/admin/permissions`);
+                    }
+                }
+            })
+            .catch(err => console.error('Failed to check admin status:', err));
+    }
+
     // Theme switcher
     const validThemes = ['light-theme', 'dark-theme', 'dark-solarized-theme'];
     
diff --git a/src/dotnet/APIView/APIViewWeb/LeanControllers/PermissionsController.cs b/src/dotnet/APIView/APIViewWeb/LeanControllers/PermissionsController.cs
new file mode 100644
index 00000000000..59e6d30da12
--- /dev/null
+++ b/src/dotnet/APIView/APIViewWeb/LeanControllers/PermissionsController.cs
@@ -0,0 +1,245 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using APIViewWeb.Helpers;
+using APIViewWeb.LeanModels;
+using APIViewWeb.Managers.Interfaces;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+
+namespace APIViewWeb.LeanControllers;
+
+public class PermissionsController : BaseApiController
+{
+    private readonly IPermissionsManager _permissionsManager;
+
+    public PermissionsController(IPermissionsManager permissionsManager)
+    {
+        _permissionsManager = permissionsManager;
+    }
+
+    /// <summary>
+    ///     Get current user's effective permissions
+    /// </summary>
+    [HttpGet("me")]
+    public async Task<ActionResult<EffectivePermissions>> GetMyPermissions()
+    {
+        var userName = User.GetGitHubLogin();
+        var permissions = await _permissionsManager.GetEffectivePermissionsAsync(userName);
+        return new LeanJsonResult(permissions, StatusCodes.Status200OK);
+    }
+
+    /// <summary>
+    ///     Get all usernames for autocomplete (Admin only)
+    /// </summary>
+    [HttpGet("users")]
+    public async Task<ActionResult<IEnumerable<string>>> GetAllUsernames()
+    {
+        var userName = User.GetGitHubLogin();
+        if (!await _permissionsManager.IsAdminAsync(userName))
+        {
+            return Forbid();
+        }
+
+        IEnumerable<string> users = await _permissionsManager.GetAllUsernamesAsync();
+        return new LeanJsonResult(users, StatusCodes.Status200OK);
+    }
+
+    /// <summary>
+    ///     Get all permission groups (Admin only)
+    /// </summary>
+    [HttpGet("groups")]
+    public async Task<ActionResult> GetAllGroups()
+    {
+        var userName = User.GetGitHubLogin();
+        var isAdmin = await _permissionsManager.IsAdminAsync(userName);
+        if (!isAdmin)
+        {
+            return Forbid();
+        }
+
+        var groups = await _permissionsManager.GetAllGroupsAsync();
+        return new LeanJsonResult(groups, StatusCodes.Status200OK);
+    }
+
+    /// <summary>
+    ///     Get a specific group by ID (Admin only)
+    /// </summary>
+    [HttpGet("groups/{groupId}")]
+    public async Task<ActionResult<GroupPermissionsModel>> GetGroup(string groupId)
+    {
+        var userName = User.GetGitHubLogin();
+        if (!await _permissionsManager.IsAdminAsync(userName))
+        {
+            return Forbid();
+        }
+
+        GroupPermissionsModel group = await _permissionsManager.GetGroupAsync(groupId);
+        if (group == null)
+        {
+            return NotFound($"Group with ID '{groupId}' not found.");
+        }
+
+        return new LeanJsonResult(group, StatusCodes.Status200OK);
+    }
+
+    /// <summary>
+    ///     Create a new permission group (Admin only)
+    /// </summary>
+    [HttpPost("groups")]
+    public async Task<ActionResult<GroupPermissionsModel>> CreateGroup([FromBody] GroupPermissionsRequest request)
+    {
+        var userName = User.GetGitHubLogin();
+        if (!await _permissionsManager.IsAdminAsync(userName))
+        {
+            return Forbid();
+        }
+
+        if (string.IsNullOrWhiteSpace(request.GroupId))
+        {
+            return BadRequest("GroupId is required.");
+        }
+
+        if (string.IsNullOrWhiteSpace(request.GroupName))
+        {
+            return BadRequest("GroupName is required.");
+        }
+
+        if (request.Roles != null)
+        {
+            foreach (var role in request.Roles)
+            {
+                if (role is LanguageScopedRoleAssignment scopedRole &&
+                    string.IsNullOrWhiteSpace(scopedRole.Language))
+                {
+                    return BadRequest("Language is required for language-scoped role assignments.");
+                }
+            }
+        }
+
+        GroupPermissionsModel existingGroup = await _permissionsManager.GetGroupAsync(request.GroupId);
+        if (existingGroup != null)
+        {
+            return Conflict($"Group with ID '{request.GroupId}' already exists.");
+        }
+
+        GroupPermissionsModel group = await _permissionsManager.CreateGroupAsync(request, userName);
+        return new LeanJsonResult(group, StatusCodes.Status201Created);
+    }
+
+    /// <summary>
+    ///     Update an existing permission group (Admin only)
+    /// </summary>
+    [HttpPut("groups/{groupId}")]
+    public async Task<ActionResult<GroupPermissionsModel>> UpdateGroup(string groupId,
+        [FromBody] GroupPermissionsRequest request)
+    {
+        var userName = User.GetGitHubLogin();
+        if (!await _permissionsManager.IsAdminAsync(userName))
+        {
+            return Forbid();
+        }
+
+        if (request.Roles != null)
+        {
+            foreach (var role in request.Roles)
+            {
+                if (role is LanguageScopedRoleAssignment scopedRole &&
+                    string.IsNullOrWhiteSpace(scopedRole.Language))
+                {
+                    return BadRequest("Language is required for language-scoped role assignments.");
+                }
+            }
+        }
+
+        try
+        {
+            GroupPermissionsModel group = await _permissionsManager.UpdateGroupAsync(groupId, request, userName);
+            return new LeanJsonResult(group, StatusCodes.Status200OK);
+        }
+        catch (ArgumentException ex)
+        {
+            return NotFound(ex.Message);
+        }
+    }
+
+    /// <summary>
+    ///     Delete a permission group (Admin only)
+    /// </summary>
+    [HttpDelete("groups/{groupId}")]
+    public async Task<ActionResult> DeleteGroup(string groupId)
+    {
+        var userName = User.GetGitHubLogin();
+        if (!await _permissionsManager.IsAdminAsync(userName))
+        {
+            return Forbid();
+        }
+
+        await _permissionsManager.DeleteGroupAsync(groupId);
+        return NoContent();
+    }
+
+    /// <summary>
+    ///     Add members to a group (Admin only)
+    /// </summary>
+    [HttpPost("groups/{groupId}/members")]
+    public async Task<ActionResult<AddMembersResult>> AddMembers(string groupId, [FromBody] AddMembersRequest request)
+    {
+        var userName = User.GetGitHubLogin();
+        if (!await _permissionsManager.IsAdminAsync(userName))
+        {
+            return Forbid();
+        }
+
+        if (request.UserIds == null || request.UserIds.Count == 0)
+        {
+            return BadRequest("At least one userId is required.");
+        }
+
+        try
+        {
+            AddMembersResult result = await _permissionsManager.AddMembersToGroupAsync(groupId, request.UserIds, userName);
+            
+            if (result.InvalidUsers.Count > 0 && result.AddedUsers.Count == 0)
+            {
+                // All users were invalid
+                return BadRequest(new { 
+                    message = "None of the specified users exist in our database.", 
+                    invalidUsers = result.InvalidUsers 
+                });
+            }
+
+            return new LeanJsonResult(result, StatusCodes.Status200OK);
+        }
+        catch (ArgumentException ex)
+        {
+            return NotFound(ex.Message);
+        }
+    }
+
+    /// <summary>
+    ///     Remove a member from a group (Admin only)
+    /// </summary>
+    [HttpDelete("groups/{groupId}/members/{userId}")]
+    public async Task<ActionResult> RemoveMember(string groupId, string userId)
+    {
+        var userName = User.GetGitHubLogin();
+        if (!await _permissionsManager.IsAdminAsync(userName))
+        {
+            return Forbid();
+        }
+
+        try
+        {
+            await _permissionsManager.RemoveMemberFromGroupAsync(groupId, userId, userName);
+            return NoContent();
+        }
+        catch (ArgumentException ex)
+        {
+            return NotFound(ex.Message);
+        }
+    }
+}
diff --git a/src/dotnet/APIView/APIViewWeb/LeanControllers/UserProfileController.cs b/src/dotnet/APIView/APIViewWeb/LeanControllers/UserProfileController.cs
index 7e6935633a6..b8b3bb435ab 100644
--- a/src/dotnet/APIView/APIViewWeb/LeanControllers/UserProfileController.cs
+++ b/src/dotnet/APIView/APIViewWeb/LeanControllers/UserProfileController.cs
@@ -1,5 +1,6 @@
 using System.Threading.Tasks;
 using APIViewWeb.Helpers;
+using APIViewWeb.Managers.Interfaces;
 using APIViewWeb.Models;
 using APIViewWeb.Repositories;
 using Microsoft.AspNetCore.Http;
@@ -10,10 +11,12 @@ namespace APIViewWeb.LeanControllers
     public class UserProfileController : BaseApiController
     {
         private readonly UserProfileCache _userProfileCache;
+        private readonly IPermissionsManager _permissionsManager;
 
-        public UserProfileController(UserProfileCache userProfileCache)
+        public UserProfileController(UserProfileCache userProfileCache, IPermissionsManager permissionsManager)
         {
             _userProfileCache = userProfileCache;
+            _permissionsManager = permissionsManager;
         }
 
         [HttpGet]
@@ -23,6 +26,8 @@ public async Task<ActionResult<UserProfileModel>> GetUserPreference([FromQuery]s
             try
             {
                 var userProfile = await _userProfileCache.GetUserProfileAsync(userName, createIfNotExist: false);
+                userProfile.Permissions = await _permissionsManager.GetEffectivePermissionsAsync(userName);
+                
                 return new LeanJsonResult(userProfile, StatusCodes.Status200OK);
             }
             catch
diff --git a/src/dotnet/APIView/APIViewWeb/LeanModels/PermissionsModels.cs b/src/dotnet/APIView/APIViewWeb/LeanModels/PermissionsModels.cs
new file mode 100644
index 00000000000..9596e0611b9
--- /dev/null
+++ b/src/dotnet/APIView/APIViewWeb/LeanModels/PermissionsModels.cs
@@ -0,0 +1,150 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json.Serialization;
+
+namespace APIViewWeb.LeanModels;
+
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum GlobalRole
+{
+    // Default value
+    Unknown = 0,
+    ServiceTeam,
+    SdkTeam,
+    Admin
+}
+
+
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum LanguageScopedRole
+{
+    DeputyArchitect = 0,
+    Architect
+}
+
+[JsonPolymorphic(TypeDiscriminatorPropertyName = "kind")]
+[JsonDerivedType(typeof(GlobalRoleAssignment), "global")]
+[JsonDerivedType(typeof(LanguageScopedRoleAssignment), "scoped")]
+public abstract class RoleAssignment
+{
+}
+
+public class GlobalRoleAssignment : RoleAssignment
+{
+    [JsonPropertyName("role")]
+    public GlobalRole Role { get; set; }
+}
+
+public class LanguageScopedRoleAssignment : RoleAssignment
+{
+    [JsonPropertyName("role")]
+    public LanguageScopedRole Role { get; set; }
+
+    [JsonPropertyName("language")]
+    public string Language { get; set; }
+}
+
+public class GroupPermissionsModel
+{
+    [JsonPropertyName("id")]
+    public string Id { get; set; }
+
+    [JsonPropertyName("type")]
+    public string Type => "group";
+
+    [JsonPropertyName("groupId")]
+    public string GroupId { get; set; }
+
+    [JsonPropertyName("groupName")]
+    public string GroupName { get; set; }
+
+    [JsonPropertyName("roles")]
+    public List<RoleAssignment> Roles { get; set; } = new();
+
+    [JsonPropertyName("members")]
+    public List<string> Members { get; set; } = new();
+
+    [JsonPropertyName("lastUpdatedOn")]
+    public DateTime LastUpdatedOn { get; set; }
+
+    [JsonPropertyName("lastUpdatedBy")]
+    public string LastUpdatedBy { get; set; }
+
+    [JsonPropertyName("serviceNames")]
+    public List<string> ServiceNames { get; set; } = new();
+}
+
+public class EffectivePermissions
+{
+    [JsonPropertyName("userId")]
+    public string UserId { get; set; }
+
+    [JsonPropertyName("roles")]
+    public List<RoleAssignment> Roles { get; set; } = new();
+
+    public bool IsAdmin => HasGlobalRole(GlobalRole.Admin);
+
+    public bool HasElevatedAccess => HasAnyGlobalRole(GlobalRole.SdkTeam, GlobalRole.Admin);
+
+    public bool HasGlobalRole(GlobalRole role)
+    {
+        return Roles.Exists(r => r is GlobalRoleAssignment gra && gra.Role == role);
+    }
+    public bool HasAnyGlobalRole(params GlobalRole[] roles)
+    {
+        return roles.Any(HasGlobalRole);
+    }
+
+    public bool HasLanguageRole(LanguageScopedRole role, string language)
+    {
+        return Roles.Exists(r =>
+            r is LanguageScopedRoleAssignment lra &&
+            lra.Role == role &&
+            string.Equals(lra.Language, language, StringComparison.OrdinalIgnoreCase));
+    }
+
+    public bool HasAnyLanguageRole(string language, params LanguageScopedRole[] roles)
+    {
+        return roles.Any(role => HasLanguageRole(role, language));
+    }
+
+    public bool CanApprove(string language)
+    {
+        return HasGlobalRole(GlobalRole.Admin) ||
+               HasAnyLanguageRole(language, LanguageScopedRole.Architect, LanguageScopedRole.DeputyArchitect);
+    }
+}
+
+public class GroupPermissionsRequest
+{
+    [JsonPropertyName("groupId")]
+    public string GroupId { get; set; }
+
+    [JsonPropertyName("groupName")]
+    public string GroupName { get; set; }
+
+    [JsonPropertyName("roles")]
+    public List<RoleAssignment> Roles { get; set; } = [];
+
+    [JsonPropertyName("serviceNames")]
+    public List<string> ServiceNames { get; set; } = [];
+}
+
+public class AddMembersRequest
+{
+    [JsonPropertyName("userIds")]
+    public List<string> UserIds { get; set; } = [];
+}
+
+public class AddMembersResult
+{
+    [JsonPropertyName("addedUsers")]
+    public List<string> AddedUsers { get; set; } = [];
+
+    [JsonPropertyName("invalidUsers")]
+    public List<string> InvalidUsers { get; set; } = [];
+
+    [JsonPropertyName("allUsersValid")]
+    public bool AllUsersValid => InvalidUsers.Count == 0;
+}
diff --git a/src/dotnet/APIView/APIViewWeb/Managers/Interfaces/IPermissionsManager.cs b/src/dotnet/APIView/APIViewWeb/Managers/Interfaces/IPermissionsManager.cs
new file mode 100644
index 00000000000..ad81bf376c4
--- /dev/null
+++ b/src/dotnet/APIView/APIViewWeb/Managers/Interfaces/IPermissionsManager.cs
@@ -0,0 +1,21 @@
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using APIViewWeb.LeanModels;
+
+namespace APIViewWeb.Managers.Interfaces;
+
+public interface IPermissionsManager
+{
+    Task<EffectivePermissions> GetEffectivePermissionsAsync(string userId);
+    Task<IEnumerable<GroupPermissionsModel>> GetAllGroupsAsync();
+    Task<GroupPermissionsModel> GetGroupAsync(string groupId);
+    Task<GroupPermissionsModel> CreateGroupAsync(GroupPermissionsRequest request, string createdBy);
+    Task<GroupPermissionsModel> UpdateGroupAsync(string groupId, GroupPermissionsRequest request, string updatedBy);
+    Task DeleteGroupAsync(string groupId);
+    Task<AddMembersResult> AddMembersToGroupAsync(string groupId, IEnumerable<string> userIds, string addedBy);
+    Task RemoveMemberFromGroupAsync(string groupId, string userId, string removedBy);
+    Task<bool> CanApproveAsync(string userId, string language);
+    Task<bool> IsAdminAsync(string userId);
+    Task<bool> HasElevatedAccessAsync(string userId);
+    Task<IEnumerable<string>> GetAllUsernamesAsync();
+}
diff --git a/src/dotnet/APIView/APIViewWeb/Managers/PermissionsManager.cs b/src/dotnet/APIView/APIViewWeb/Managers/PermissionsManager.cs
new file mode 100644
index 00000000000..aaac45bcb6d
--- /dev/null
+++ b/src/dotnet/APIView/APIViewWeb/Managers/PermissionsManager.cs
@@ -0,0 +1,230 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using APIViewWeb.LeanModels;
+using APIViewWeb.Managers.Interfaces;
+using APIViewWeb.Repositories;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging;
+
+namespace APIViewWeb.Managers;
+
+public class PermissionsManager : IPermissionsManager
+{
+    private const string EffectivePermissionsCacheKeyPrefix = "EffectivePermissions_";
+
+    private static readonly TimeSpan CacheExpiration = TimeSpan.FromMinutes(15);
+    private readonly IMemoryCache _cache;
+    private readonly ILogger<PermissionsManager> _logger;
+    private readonly ICosmosPermissionsRepository _permissionsRepository;
+    private readonly ICosmosUserProfileRepository _userProfileRepository;
+
+    public PermissionsManager(
+        ICosmosPermissionsRepository permissionsRepository,
+        ICosmosUserProfileRepository userProfileRepository,
+        IMemoryCache cache,
+        ILogger<PermissionsManager> logger)
+    {
+        _permissionsRepository = permissionsRepository;
+        _userProfileRepository = userProfileRepository;
+        _cache = cache;
+        _logger = logger;
+    }
+
+    public async Task<EffectivePermissions> GetEffectivePermissionsAsync(string userId)
+    {
+        if (string.IsNullOrWhiteSpace(userId))
+        {
+            return new EffectivePermissions { UserId = userId, Roles = new List<RoleAssignment>() };
+        }
+
+        var cacheKey = $"{EffectivePermissionsCacheKeyPrefix}{userId.ToLowerInvariant()}";
+        if (_cache.TryGetValue(cacheKey, out EffectivePermissions cachedPermissions))
+        {
+            return cachedPermissions;
+        }
+
+        IEnumerable<GroupPermissionsModel> groups = await _permissionsRepository.GetGroupsForUserAsync(userId);
+        EffectivePermissions effectivePermissions = MergePermissions(userId, groups);
+
+        _cache.Set(cacheKey, effectivePermissions, CacheExpiration);
+        return effectivePermissions;
+    }
+
+    public async Task<IEnumerable<GroupPermissionsModel>> GetAllGroupsAsync()
+    {
+        return await _permissionsRepository.GetAllGroupsAsync();
+    }
+
+    public async Task<GroupPermissionsModel> GetGroupAsync(string groupId)
+    {
+        return await _permissionsRepository.GetGroupAsync(groupId);
+    }
+
+    public async Task<GroupPermissionsModel> CreateGroupAsync(GroupPermissionsRequest request, string createdBy)
+    {
+        var group = new GroupPermissionsModel
+        {
+            GroupId = request.GroupId,
+            GroupName = request.GroupName,
+            Roles = request.Roles ?? new List<RoleAssignment>(),
+            Members = new List<string>(),
+            ServiceNames = request.ServiceNames ?? new List<string>(),
+            LastUpdatedBy = createdBy,
+            LastUpdatedOn = DateTime.UtcNow
+        };
+
+        await _permissionsRepository.UpsertGroupAsync(group);
+        _logger.LogInformation("Permission group '{GroupId}' created by {User}", group.GroupId, createdBy);
+
+        return group;
+    }
+
+    public async Task<GroupPermissionsModel> UpdateGroupAsync(string groupId, GroupPermissionsRequest request, string updatedBy)
+    {
+        var existingGroup = await _permissionsRepository.GetGroupAsync(groupId);
+        if (existingGroup == null)
+        {
+            throw new ArgumentException($"Group with ID '{groupId}' not found.");
+        }
+
+        existingGroup.GroupName = request.GroupName;
+        existingGroup.Roles = request.Roles ?? new List<RoleAssignment>();
+        existingGroup.ServiceNames = request.ServiceNames ?? new List<string>();
+        existingGroup.LastUpdatedBy = updatedBy;
+        existingGroup.LastUpdatedOn = DateTime.UtcNow;
+
+        await _permissionsRepository.UpsertGroupAsync(existingGroup);
+
+        InvalidateMembersCaches(existingGroup.Members);
+
+        _logger.LogInformation("Permission group '{GroupId}' updated by {User}", groupId, updatedBy);
+
+        return existingGroup;
+    }
+
+    public async Task DeleteGroupAsync(string groupId)
+    {
+        var group = await _permissionsRepository.GetGroupAsync(groupId);
+        if (group != null)
+        {
+            InvalidateMembersCaches(group.Members);
+        }
+
+        await _permissionsRepository.DeleteGroupAsync(groupId);
+        _logger.LogInformation("Permission group '{GroupId}' deleted", groupId);
+    }
+
+    public async Task<AddMembersResult> AddMembersToGroupAsync(string groupId, IEnumerable<string> userNames, string addedBy)
+    {
+        List<string> userNamesList = userNames.ToList();
+        List<string> existingUsers = (await _userProfileRepository.GetExistingUsersAsync(userNamesList)).ToList();
+        var existingUsersSet = new HashSet<string>(existingUsers, StringComparer.OrdinalIgnoreCase);
+
+        var result = new AddMembersResult();
+        foreach (string userName in userNamesList)
+        {
+            if (existingUsersSet.Contains(userName))
+            {
+                result.AddedUsers.Add(userName);
+            }
+            else
+            {
+                result.InvalidUsers.Add(userName);
+            }
+        }
+
+        if (result.AddedUsers.Count > 0)
+        {
+            await _permissionsRepository.AddMembersToGroupAsync(groupId, result.AddedUsers);
+            InvalidateMembersCaches(result.AddedUsers);
+        }
+
+        return result;
+    }
+
+    public async Task RemoveMemberFromGroupAsync(string groupId, string userId, string removedBy)
+    {
+        await _permissionsRepository.RemoveMemberFromGroupAsync(groupId, userId);
+        InvalidateMembersCaches(new[] { userId });
+
+        _logger.LogInformation("Member '{UserId}' removed from group '{GroupId}' by {User}",
+            userId, groupId, removedBy);
+    }
+
+    public async Task<bool> CanApproveAsync(string userId, string language)
+    {
+        EffectivePermissions permissions = await GetEffectivePermissionsAsync(userId);
+        return permissions.CanApprove(language);
+    }
+
+    public async Task<bool> IsAdminAsync(string userId)
+    {
+        EffectivePermissions permissions = await GetEffectivePermissionsAsync(userId);
+        return permissions.IsAdmin;
+    }
+
+    public async Task<bool> HasElevatedAccessAsync(string userId)
+    {
+        EffectivePermissions permissions = await GetEffectivePermissionsAsync(userId);
+        return permissions.HasElevatedAccess;
+    }
+
+    public async Task<IEnumerable<string>> GetAllUsernamesAsync()
+    {
+        return await _userProfileRepository.GetAllUsernamesAsync();
+    }
+
+    private EffectivePermissions MergePermissions(string userId, IEnumerable<GroupPermissionsModel> groups)
+    {
+        var mergedRoles = new List<RoleAssignment>();
+        var globalRolesAdded = new HashSet<GlobalRole>();
+        var languageScopedRolesAdded = new HashSet<(LanguageScopedRole role, string language)>();
+
+        foreach (var group in groups)
+        {
+            foreach (var role in group.Roles)
+            {
+                switch (role)
+                {
+                    case GlobalRoleAssignment globalRole:
+                    {
+                        if (globalRolesAdded.Add(globalRole.Role))
+                        {
+                            mergedRoles.Add(role);
+                        }
+
+                        break;
+                    }
+                    case LanguageScopedRoleAssignment scopedRole:
+                    {
+                        var key = (scopedRole.Role, scopedRole.Language?.ToLowerInvariant());
+                        if (languageScopedRolesAdded.Add(key))
+                        {
+                            mergedRoles.Add(role);
+                        }
+
+                        break;
+                    }
+                }
+            }
+        }
+
+        if (mergedRoles.Count == 0)
+        {
+            mergedRoles.Add(new GlobalRoleAssignment { Role = GlobalRole.SdkTeam });
+        }
+
+        return new EffectivePermissions { UserId = userId, Roles = mergedRoles };
+    }
+
+    private void InvalidateMembersCaches(IEnumerable<string> userIds)
+    {
+        foreach (var userId in userIds)
+        {
+            var cacheKey = $"{EffectivePermissionsCacheKeyPrefix}{userId.ToLowerInvariant()}";
+            _cache.Remove(cacheKey);
+        }
+    }
+}
diff --git a/src/dotnet/APIView/APIViewWeb/Models/UserProfileModel.cs b/src/dotnet/APIView/APIViewWeb/Models/UserProfileModel.cs
index c6fbc639015..9ccdf1e2672 100644
--- a/src/dotnet/APIView/APIViewWeb/Models/UserProfileModel.cs
+++ b/src/dotnet/APIView/APIViewWeb/Models/UserProfileModel.cs
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 using System.Text.Json.Serialization;
+using APIViewWeb.LeanModels;
 
 namespace APIViewWeb.Models
 {
@@ -26,6 +27,8 @@ public UserProfileModel(string username)
         
         public string Email { get; set; }
         public UserPreferenceModel Preferences { get; set; }
-
+        
+        [JsonPropertyName("permissions")]
+        public EffectivePermissions Permissions { get; set; }
     }
 }
diff --git a/src/dotnet/APIView/APIViewWeb/Pages/Shared/_Layout.cshtml b/src/dotnet/APIView/APIViewWeb/Pages/Shared/_Layout.cshtml
index f3c3b1aeaa4..a3efe0b50dd 100644
--- a/src/dotnet/APIView/APIViewWeb/Pages/Shared/_Layout.cshtml
+++ b/src/dotnet/APIView/APIViewWeb/Pages/Shared/_Layout.cshtml
@@ -75,6 +75,12 @@
                         </li>
                         
                         @if (User.Identity.IsAuthenticated) {
+                            <!-- Admin Settings link (for admins) -->
+                            <li class="nav-item admin-settings-item d-none">
+                                <a href="#" class="nav-link nav-icon" title="Admin Settings" target="_blank">
+                                    <i class="bi bi-shield-lock"></i>
+                                </a>
+                            </li>
                             <!-- User profile avatar with dropdown -->
                             <li class="nav-item dropdown">
                                 <a class="nav-link dropdown-toggle nav-avatar" href="#" role="button" data-bs-toggle="dropdown" aria-expanded="false">
diff --git a/src/dotnet/APIView/APIViewWeb/Repositories/CosmosPermissionsRepository.cs b/src/dotnet/APIView/APIViewWeb/Repositories/CosmosPermissionsRepository.cs
new file mode 100644
index 00000000000..9d980cf6f3e
--- /dev/null
+++ b/src/dotnet/APIView/APIViewWeb/Repositories/CosmosPermissionsRepository.cs
@@ -0,0 +1,134 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Threading.Tasks;
+using APIViewWeb.LeanModels;
+using Microsoft.Azure.Cosmos;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+
+namespace APIViewWeb.Repositories;
+
+public class CosmosPermissionsRepository : ICosmosPermissionsRepository
+{
+    private readonly Container _permissionsContainer;
+    private readonly ILogger<CosmosPermissionsRepository> _logger;
+
+    public CosmosPermissionsRepository(IConfiguration configuration, CosmosClient cosmosClient,
+        ILogger<CosmosPermissionsRepository> logger)
+    {
+        _permissionsContainer = cosmosClient.GetContainer(configuration["CosmosDBName"], "Permissions");
+        _logger = logger;
+    }
+
+    public async Task<IEnumerable<GroupPermissionsModel>> GetGroupsForUserAsync(string userId)
+    {
+        string queryText = @"
+                SELECT * FROM c 
+                WHERE c.type = 'group' 
+                AND ARRAY_CONTAINS(c.members, @userId)";
+
+        var queryDefinition = new QueryDefinition(queryText)
+            .WithParameter("@userId", userId);
+
+        var groups = new List<GroupPermissionsModel>();
+        var iterator = _permissionsContainer.GetItemQueryIterator<GroupPermissionsModel>(queryDefinition);
+
+        while (iterator.HasMoreResults)
+        {
+            var response = await iterator.ReadNextAsync();
+            groups.AddRange(response.Resource);
+        }
+
+        return groups;
+    }
+
+    public async Task<IEnumerable<GroupPermissionsModel>> GetAllGroupsAsync()
+    {
+        string queryText = "SELECT * FROM c WHERE c.type = 'group'";
+        var queryDefinition = new QueryDefinition(queryText);
+
+        var groups = new List<GroupPermissionsModel>();
+        var iterator = _permissionsContainer.GetItemQueryIterator<GroupPermissionsModel>(queryDefinition);
+
+        while (iterator.HasMoreResults)
+        {
+            var response = await iterator.ReadNextAsync();
+            groups.AddRange(response.Resource);
+        }
+
+        return groups;
+    }
+
+    public async Task<GroupPermissionsModel> GetGroupAsync(string groupId)
+    {
+        try
+        {
+            string documentId = $"group-{groupId}";
+            var response = await _permissionsContainer.ReadItemAsync<GroupPermissionsModel>(
+                documentId,
+                new PartitionKey(documentId));
+            return response.Resource;
+        }
+        catch (CosmosException ex) when (ex.StatusCode == HttpStatusCode.NotFound)
+        {
+            return null;
+        }
+    }
+
+    public async Task UpsertGroupAsync(GroupPermissionsModel group)
+    {
+        group.Id = $"group-{group.GroupId}";
+        group.LastUpdatedOn = DateTime.UtcNow;
+        await _permissionsContainer.UpsertItemAsync(group, new PartitionKey(group.Id));
+    }
+
+    public async Task DeleteGroupAsync(string groupId)
+    {
+        string documentId = $"group-{groupId}";
+        try
+        {
+            await _permissionsContainer.DeleteItemAsync<GroupPermissionsModel>(
+                documentId,
+                new PartitionKey(documentId));
+        }
+        catch (CosmosException ex) when (ex.StatusCode == HttpStatusCode.NotFound)
+        {
+            _logger.LogWarning("Attempted to delete non-existent group: {GroupId}", groupId);
+        }
+    }
+
+    public async Task AddMembersToGroupAsync(string groupId, IEnumerable<string> userIds)
+    {
+        GroupPermissionsModel group = await GetGroupAsync(groupId);
+        if (group == null)
+        {
+            throw new ArgumentException($"Group with ID '{groupId}' not found.");
+        }
+
+        var existingMembers = new HashSet<string>(group.Members, StringComparer.OrdinalIgnoreCase);
+        foreach (var userId in userIds)
+        {
+            existingMembers.Add(userId);
+        }
+
+        group.Members = existingMembers.ToList();
+        await UpsertGroupAsync(group);
+    }
+
+    public async Task RemoveMemberFromGroupAsync(string groupId, string userId)
+    {
+        GroupPermissionsModel group = await GetGroupAsync(groupId);
+        if (group == null)
+        {
+            throw new ArgumentException($"Group with ID '{groupId}' not found.");
+        }
+
+        group.Members = group.Members
+            .Where(m => !string.Equals(m, userId, StringComparison.OrdinalIgnoreCase))
+            .ToList();
+
+        await UpsertGroupAsync(group);
+    }
+}
diff --git a/src/dotnet/APIView/APIViewWeb/Repositories/CosmosUserProfileRepository.cs b/src/dotnet/APIView/APIViewWeb/Repositories/CosmosUserProfileRepository.cs
index 6c3cdd74a99..a1282175dd1 100644
--- a/src/dotnet/APIView/APIViewWeb/Repositories/CosmosUserProfileRepository.cs
+++ b/src/dotnet/APIView/APIViewWeb/Repositories/CosmosUserProfileRepository.cs
@@ -1,11 +1,14 @@
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
+using System.Collections.Generic;
+using System.Linq;
 using System.Security.Claims;
 using System.Threading.Tasks;
 using APIViewWeb.Models;
 using APIViewWeb.Repositories;
 using Microsoft.Azure.Cosmos;
+using Microsoft.Azure.Cosmos.Linq;
 using Microsoft.Azure.Cosmos.Serialization.HybridRow;
 using Microsoft.Extensions.Configuration;
 
@@ -58,5 +61,46 @@ public async Task<Result> UpsertUserProfileAsync(string userName, UserProfileMod
                 return Result.Failure;
             }
         }
+
+        public async Task<IEnumerable<string>> GetAllUsernamesAsync()
+        {
+            var queryable = _userProfileContainer.GetItemLinqQueryable<UserProfileModel>();
+            var query = queryable.Select(u => u.UserName);
+
+            using var iterator = query.ToFeedIterator();
+            var users = new List<string>();
+            while (iterator.HasMoreResults)
+            {
+                var response = await iterator.ReadNextAsync();
+                users.AddRange(response);
+            }
+
+            return users;
+        }
+
+        public async Task<IEnumerable<string>> GetExistingUsersAsync(IEnumerable<string> userNames)
+        {
+            var existingUsers = new List<string>();
+            var userNamesList = userNames.ToList();
+            
+            if (userNamesList.Count == 0)
+            {
+                return existingUsers;
+            }
+
+            var queryable = _userProfileContainer.GetItemLinqQueryable<UserProfileModel>();
+            IQueryable<string> query = queryable
+                .Where(u => userNamesList.Contains(u.UserName))
+                .Select(u => u.UserName);
+
+            using var iterator = query.ToFeedIterator();
+            while (iterator.HasMoreResults)
+            {
+                var response = await iterator.ReadNextAsync();
+                existingUsers.AddRange(response);
+            }
+
+            return existingUsers;
+        }
     }
 }
diff --git a/src/dotnet/APIView/APIViewWeb/Repositories/Interfaces/ICosmosPermissionsRepository.cs b/src/dotnet/APIView/APIViewWeb/Repositories/Interfaces/ICosmosPermissionsRepository.cs
new file mode 100644
index 00000000000..46ae364c749
--- /dev/null
+++ b/src/dotnet/APIView/APIViewWeb/Repositories/Interfaces/ICosmosPermissionsRepository.cs
@@ -0,0 +1,16 @@
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using APIViewWeb.LeanModels;
+
+namespace APIViewWeb.Repositories;
+
+public interface ICosmosPermissionsRepository
+{
+    Task<IEnumerable<GroupPermissionsModel>> GetGroupsForUserAsync(string userId);
+    Task<IEnumerable<GroupPermissionsModel>> GetAllGroupsAsync();
+    Task<GroupPermissionsModel> GetGroupAsync(string groupId);
+    Task UpsertGroupAsync(GroupPermissionsModel group);
+    Task DeleteGroupAsync(string groupId);
+    Task AddMembersToGroupAsync(string groupId, IEnumerable<string> userIds);
+    Task RemoveMemberFromGroupAsync(string groupId, string userId);
+}
diff --git a/src/dotnet/APIView/APIViewWeb/Repositories/Interfaces/ICosmosUserProfileRepository.cs b/src/dotnet/APIView/APIViewWeb/Repositories/Interfaces/ICosmosUserProfileRepository.cs
index fa993c5279e..177007d28d0 100644
--- a/src/dotnet/APIView/APIViewWeb/Repositories/Interfaces/ICosmosUserProfileRepository.cs
+++ b/src/dotnet/APIView/APIViewWeb/Repositories/Interfaces/ICosmosUserProfileRepository.cs
@@ -1,5 +1,6 @@
 using APIViewWeb.Models;
 using Microsoft.Azure.Cosmos.Serialization.HybridRow;
+using System.Collections.Generic;
 using System.Security.Claims;
 using System.Threading.Tasks;
 
@@ -10,5 +11,7 @@ public interface ICosmosUserProfileRepository
         public Task<UserProfileModel> TryGetUserProfileAsync(string userName, bool createIfNotExist = true);
         public Task<Result> UpsertUserProfileAsync(ClaimsPrincipal user, UserProfileModel userModel);
         public Task<Result> UpsertUserProfileAsync(string userName, UserProfileModel userModel);
+        public Task<IEnumerable<string>> GetAllUsernamesAsync();
+        public Task<IEnumerable<string>> GetExistingUsersAsync(IEnumerable<string> userNames);
     }
 }
diff --git a/src/dotnet/APIView/APIViewWeb/Startup.cs b/src/dotnet/APIView/APIViewWeb/Startup.cs
index af6c2a64ada..39f21dcdae4 100644
--- a/src/dotnet/APIView/APIViewWeb/Startup.cs
+++ b/src/dotnet/APIView/APIViewWeb/Startup.cs
@@ -73,6 +73,7 @@ public void ConfigureServices(IServiceCollection services)
             services.AddApplicationInsightsTelemetry();
             services.AddApplicationInsightsTelemetryProcessor<TelemetryIpAddressFilter>();
             services.AddAzureAppConfiguration();
+            services.AddMemoryCache();
 
             services.AddResponseCompression(options =>
             {
@@ -129,6 +130,7 @@ public void ConfigureServices(IServiceCollection services)
             services.AddSingleton<ICosmosPullRequestsRepository, CosmosPullRequestsRepository>();
             services.AddSingleton<ICosmosSamplesRevisionsRepository, CosmosSamplesRevisionsRepository>();
             services.AddSingleton<ICosmosUserProfileRepository, CosmosUserProfileRepository>();
+            services.AddSingleton<ICosmosPermissionsRepository, CosmosPermissionsRepository>();
             services.AddSingleton<IDevopsArtifactRepository, DevopsArtifactRepository>();
 
             services.AddSingleton<IReviewManager, ReviewManager>();
@@ -143,6 +145,7 @@ public void ConfigureServices(IServiceCollection services)
             services.AddSingleton<ISamplesRevisionsManager, SamplesRevisionsManager>();
             services.AddSingleton<ICodeFileManager, CodeFileManager>();
             services.AddSingleton<IUserProfileManager, UserProfileManager>();
+            services.AddSingleton<IPermissionsManager, PermissionsManager>();
             services.AddSingleton<IGitHubClientFactory, GitHubClientFactory>();
             services.AddSingleton<UserProfileCache>();
 
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.html b/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.html
new file mode 100644
index 00000000000..1a6a7762776
--- /dev/null
+++ b/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.html
@@ -0,0 +1,371 @@
+<p-confirmDialog></p-confirmDialog>
+<div class="admin-permissions-container">
+    <!-- Hero Header -->
+    <div class="page-header">
+        <div class="header-content">
+            <div class="header-icon">
+                <i class="pi pi-shield"></i>
+            </div>
+            <div class="header-text">
+                <h1>Permission Groups</h1>
+                <p class="subtitle">Manage user groups, roles, and access permissions</p>
+            </div>
+        </div>
+    </div>
+
+    <!-- Loading State -->
+    <div *ngIf="isLoading" class="loading-container">
+        <div class="loading-spinner">
+            <i class="pi pi-spin pi-spinner"></i>
+        </div>
+        <p>Loading permissions data...</p>
+    </div>
+
+    <!-- Access Denied -->
+    <div *ngIf="!isLoading && !isAdmin" class="access-denied">
+        <div class="denied-icon">
+            <i class="pi pi-lock"></i>
+        </div>
+        <h2>Access Restricted</h2>
+        <p>You need Administrator permissions to manage groups.</p>
+        <p class="hint">Contact your system administrator for access.</p>
+    </div>
+
+    <!-- Main Content (Admin Only) -->
+    <div *ngIf="!isLoading && isAdmin" class="main-content">
+        <!-- Groups Panel -->
+        <div class="groups-panel">
+            <div class="panel-header">
+                <div class="panel-title">
+                    <i class="pi pi-users"></i>
+                    <h2>Groups</h2>
+                </div>
+                <button pButton label="New Group" icon="pi pi-plus" 
+                    class="p-button-sm p-button-rounded" (click)="openCreateGroupDialog()"></button>
+            </div>
+
+            <div class="groups-list" *ngIf="groups.length > 0">
+                <div *ngFor="let group of groups; let i = index" 
+                    class="group-card" 
+                    [class.selected]="selectedGroup?.groupId === group.groupId"
+                    [style.animation-delay]="i * 50 + 'ms'"
+                    (click)="selectGroup(group)">
+                    
+                    <div class="group-avatar" [style.background]="getGroupColor(i)">
+                        {{ group.groupName.charAt(0).toUpperCase() }}
+                    </div>
+                    
+                    <div class="group-info">
+                        <h3>{{ group.groupName }}</h3>
+                        <span class="group-id">{{ group.groupId }}</span>
+                        <div class="group-badges">
+                            <span class="badge members-badge">
+                                <i class="pi pi-users"></i> {{ group.members.length }}
+                            </span>
+                            <span class="badge roles-badge">
+                                <i class="pi pi-key"></i> {{ group.roles.length }}
+                            </span>
+                        </div>
+                    </div>
+                    
+                    <div class="group-actions">
+                        <button pButton icon="pi pi-pencil" 
+                            class="p-button-rounded p-button-text p-button-sm action-btn"
+                            pTooltip="Edit group" tooltipPosition="top"
+                            (click)="openEditGroupDialog(group); $event.stopPropagation()"></button>
+                        <button pButton icon="pi pi-trash" 
+                            class="p-button-rounded p-button-text p-button-danger p-button-sm action-btn"
+                            pTooltip="Delete group" tooltipPosition="top"
+                            (click)="deleteGroup(group); $event.stopPropagation()"></button>
+                    </div>
+                </div>
+            </div>
+
+            <div *ngIf="groups.length === 0" class="empty-state">
+                <div class="empty-illustration">
+                    <i class="pi pi-inbox"></i>
+                </div>
+                <h3>No groups yet</h3>
+                <p>Create your first permission group to get started</p>
+                <button pButton label="Create Group" icon="pi pi-plus" 
+                    class="p-button-outlined" (click)="openCreateGroupDialog()"></button>
+            </div>
+        </div>
+
+        <!-- Group Details Panel -->
+        <div class="details-panel" *ngIf="selectedGroup">
+            <!-- Detail Header -->
+            <div class="detail-header">
+                <div class="detail-title-row">
+                    <div class="detail-avatar" [style.background]="getGroupColor(groups.indexOf(selectedGroup))">
+                        {{ selectedGroup.groupName.charAt(0).toUpperCase() }}
+                    </div>
+                    <div class="detail-title">
+                        <h2>{{ selectedGroup.groupName }}</h2>
+                        <code class="group-id-code">{{ selectedGroup.groupId }}</code>
+                    </div>
+                </div>
+                <div class="detail-meta">
+                    <span class="meta-item">
+                        <i class="pi pi-clock"></i>
+                        Updated {{ formatDate(selectedGroup.lastUpdatedOn) }}
+                    </span>
+                    <span class="meta-item">
+                        <i class="pi pi-user"></i>
+                        by {{ selectedGroup.lastUpdatedBy }}
+                    </span>
+                </div>
+            </div>
+
+            <!-- Roles Section -->
+            <div class="detail-section">
+                <div class="section-header">
+                    <div class="section-title">
+                        <i class="pi pi-key"></i>
+                        <h3>Assigned Roles</h3>
+                        <span class="section-badge">{{ selectedGroup.roles.length }}</span>
+                    </div>
+                </div>
+                <div class="roles-grid">
+                    <div *ngFor="let role of selectedGroup.roles" 
+                        class="role-card" 
+                        [class.global-role]="role.kind === 'global'"
+                        [class.scoped-role]="role.kind === 'scoped'">
+                        <div class="role-icon">
+                            <i [class]="role.kind === 'global' ? 'pi pi-globe' : 'pi pi-code'"></i>
+                        </div>
+                        <div class="role-info">
+                            <span class="role-name">{{ formatRoleName(role.role) }}</span>
+                            <span class="role-scope" *ngIf="role.kind === 'scoped'">{{ role.language }}</span>
+                            <span class="role-scope" *ngIf="role.kind === 'global'">Global Access</span>
+                        </div>
+                    </div>
+                    <div *ngIf="selectedGroup.roles.length === 0" class="empty-roles">
+                        <i class="pi pi-info-circle"></i>
+                        <span>No roles assigned to this group</span>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Members Section -->
+            <div class="detail-section">
+                <div class="section-header">
+                    <div class="section-title">
+                        <i class="pi pi-users"></i>
+                        <h3>Members</h3>
+                        <span class="section-badge">{{ selectedGroup.members.length }}</span>
+                        <button pButton label="Add" icon="pi pi-plus" 
+                            class="p-button-sm p-button-text" 
+                            (click)="openAddMemberDialog()"></button>
+                    </div>
+                </div>
+                <div class="members-grid">
+                    <div *ngFor="let member of selectedGroup.members" class="member-card">
+                        <div class="member-avatar">
+                            {{ member.charAt(0).toUpperCase() }}
+                        </div>
+                        <span class="member-name">{{ member }}</span>
+                        <button pButton icon="pi pi-times" 
+                            class="p-button-rounded p-button-text p-button-danger p-button-sm remove-btn"
+                            pTooltip="Remove member" tooltipPosition="top"
+                            (click)="removeMember(member)"></button>
+                    </div>
+                    <div *ngIf="selectedGroup.members.length === 0" class="empty-members">
+                        <span>No members in this group</span>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Services Section -->
+            <div class="detail-section" *ngIf="selectedGroup.serviceNames && selectedGroup.serviceNames.length > 0">
+                <div class="section-header">
+                    <div class="section-title">
+                        <i class="pi pi-box"></i>
+                        <h3>Associated Services</h3>
+                    </div>
+                </div>
+                <div class="services-grid">
+                    <span *ngFor="let service of selectedGroup.serviceNames" class="service-tag">
+                        {{ service }}
+                    </span>
+                </div>
+            </div>
+        </div>
+
+        <!-- No Group Selected State -->
+        <div class="details-panel empty-details" *ngIf="!selectedGroup && groups.length > 0">
+            <div class="empty-details-content">
+                <div class="empty-illustration large">
+                    <i class="pi pi-arrow-left"></i>
+                </div>
+                <h3>Select a Group</h3>
+                <p>Choose a group from the list to view and manage its details</p>
+            </div>
+        </div>
+    </div>
+</div>
+
+<!-- Create/Edit Group Dialog -->
+<p-dialog [(visible)]="showGroupDialog" 
+    [header]="isEditMode ? '✏️ Edit Group' : '✨ Create New Group'" 
+    [modal]="true" 
+    [draggable]="false"
+    [style]="{ width: '550px' }"
+    styleClass="custom-dialog">
+    
+    <div class="dialog-content">
+        <!-- Group ID (only for create) -->
+        <div class="form-field" *ngIf="!isEditMode">
+            <label for="groupId">
+                <i class="pi pi-hashtag"></i> Group ID
+            </label>
+            <input pInputText id="groupId" [(ngModel)]="groupForm.groupId" 
+                placeholder="e.g., python-architects" class="w-full input-enhanced" />
+            <small class="field-hint">
+                <i class="pi pi-info-circle"></i>
+                Unique identifier - cannot be changed after creation
+            </small>
+        </div>
+
+        <!-- Group Name -->
+        <div class="form-field">
+            <label for="groupName">
+                <i class="pi pi-tag"></i> Display Name
+            </label>
+            <input pInputText id="groupName" [(ngModel)]="groupForm.groupName" 
+                placeholder="e.g., Python Architects Team" class="w-full input-enhanced" />
+        </div>
+
+        <!-- Roles Section -->
+        <div class="form-field roles-field">
+            <label>
+                <i class="pi pi-key"></i> Roles
+            </label>
+            
+            <!-- Role Type Toggle -->
+            <div class="role-type-toggle">
+                <p-selectButton [options]="[{label: '🌐 Global Role', value: 'global'}, {label: '🔤 Language Role', value: 'scoped'}]" 
+                    [(ngModel)]="newRoleKind" optionLabel="label" optionValue="value"></p-selectButton>
+            </div>
+            
+            <!-- Add Role Form -->
+            <div class="add-role-form">
+                <div class="role-selectors">
+                    <!-- Global Role Selector -->
+                    <p-select *ngIf="newRoleKind === 'global'" 
+                        [(ngModel)]="newGlobalRole" 
+                        [options]="globalRoleOptions"
+                        optionLabel="label" 
+                        optionValue="value"
+                        placeholder="Select Role"
+                        appendTo="body"
+                        class="role-select flex-grow">
+                    </p-select>
+
+                    <!-- Scoped Role Selectors -->
+                    <ng-container *ngIf="newRoleKind === 'scoped'">
+                        <p-select [(ngModel)]="newScopedRole" 
+                            [options]="languageScopedRoleOptions"
+                            optionLabel="label" 
+                            optionValue="value"
+                            placeholder="Select Role"
+                            appendTo="body"
+                            class="role-select">
+                        </p-select>
+                        <p-select [(ngModel)]="newRoleLanguage" 
+                            [options]="languageOptions"
+                            optionLabel="label" 
+                            optionValue="value"
+                            placeholder="Language"
+                            appendTo="body"
+                            class="language-select">
+                        </p-select>
+                    </ng-container>
+
+                    <button pButton icon="pi pi-plus" label="Add" 
+                        class="p-button-sm p-button-outlined add-role-btn" 
+                        (click)="addRoleToForm()"></button>
+                </div>
+            </div>
+
+            <!-- Current Roles -->
+            <div class="current-roles" *ngIf="groupForm.roles.length > 0">
+                <div *ngFor="let role of groupForm.roles; let i = index" 
+                    class="role-chip"
+                    [class.global]="role.kind === 'global'"
+                    [class.scoped]="role.kind === 'scoped'">
+                    <i [class]="role.kind === 'global' ? 'pi pi-globe' : 'pi pi-code'"></i>
+                    <span>{{ getRoleDisplayName(role) }}</span>
+                    <button pButton icon="pi pi-times" 
+                        class="p-button-rounded p-button-text p-button-sm chip-remove" 
+                        (click)="removeRoleFromForm(i)"></button>
+                </div>
+            </div>
+            <div class="no-roles-hint" *ngIf="groupForm.roles.length === 0">
+                <i class="pi pi-info-circle"></i>
+                <span>Add at least one role to this group</span>
+            </div>
+        </div>
+    </div>
+
+    <ng-template pTemplate="footer">
+        <div class="dialog-footer">
+            <button pButton label="Cancel" icon="pi pi-times" 
+                class="p-button-text p-button-secondary" 
+                (click)="showGroupDialog = false"></button>
+            <button pButton [label]="isEditMode ? 'Save Changes' : 'Create Group'" 
+                [icon]="isEditMode ? 'pi pi-check' : 'pi pi-plus'"
+                class="p-button-rounded"
+                (click)="saveGroup()"
+                [disabled]="!groupForm.groupId || !groupForm.groupName"></button>
+        </div>
+    </ng-template>
+</p-dialog>
+
+<!-- Add Member Dialog -->
+<p-dialog [(visible)]="showAddMemberDialog" 
+    header="👤 Add Team Members" 
+    [modal]="true" 
+    [draggable]="false"
+    [style]="{ width: '500px' }"
+    styleClass="custom-dialog"
+    [contentStyle]="{ 'padding-bottom': '1rem' }">
+    
+    <div class="dialog-content">
+        <div class="member-dialog-header">
+            <p>Add members to <strong>{{ selectedGroup?.groupName }}</strong></p>
+        </div>
+        <div class="form-field">
+            <label for="memberUsername">
+                <i class="pi pi-github"></i> GitHub Usernames
+            </label>
+            <p-autoComplete 
+                [(ngModel)]="newMemberUsernames" 
+                [suggestions]="userSuggestions"
+                (completeMethod)="searchUsers($event)"
+                [multiple]="true"
+                [dropdown]="false"
+                placeholder="Type to search users..."
+                class="w-full"
+                inputStyleClass="w-full input-enhanced"
+                [showEmptyMessage]="true"
+                emptyMessage="No matching users found"
+                appendTo="body">
+            </p-autoComplete>
+            <small class="field-hint">
+                <i class="pi pi-info-circle"></i>
+                Start typing to search for users. You can add multiple users at once.
+            </small>
+        </div>
+    </div>
+
+    <ng-template pTemplate="footer">
+        <button pButton label="Cancel" icon="pi pi-times" 
+            class="p-button-text p-button-secondary" 
+            (click)="showAddMemberDialog = false"></button>
+        <button pButton label="Add Members" icon="pi pi-user-plus" 
+            class="p-button-rounded"
+            (click)="addMembers()" 
+            [disabled]="newMemberUsernames.length === 0"></button>
+    </ng-template>
+</p-dialog>
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.scss b/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.scss
new file mode 100644
index 00000000000..88a1916b8e5
--- /dev/null
+++ b/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.scss
@@ -0,0 +1,102 @@
+// Admin Permissions Page
+
+.admin-permissions-container { padding: 2rem; min-height: 100vh; background: var(--surface-ground); }
+
+// Header
+.page-header {
+  display: flex; justify-content: space-between; align-items: center; margin-bottom: 1.5rem;
+  padding: 1.25rem; background: var(--surface-card); border-radius: 8px; border: 1px solid var(--surface-border);
+  .header-content { display: flex; align-items: center; gap: 1rem; }
+  .header-icon { width: 48px; height: 48px; display: flex; align-items: center; justify-content: center; background: #10b981; border-radius: 10px; i { font-size: 1.5rem; color: white; } }
+  .header-text { h1 { margin: 0; font-size: 1.5rem; } .subtitle { margin: 0.25rem 0 0; color: var(--text-color-secondary); } }
+  .header-stats { display: flex; gap: 1rem; }
+  .stat-card { text-align: center; padding: 0.5rem 1rem; background: var(--surface-ground); border-radius: 8px; .stat-value { font-size: 1.25rem; font-weight: 600; color: var(--primary-color); } .stat-label { font-size: 0.75rem; color: var(--text-color-secondary); } }
+}
+
+// Loading & Access Denied
+.loading-container, .access-denied { display: flex; flex-direction: column; align-items: center; justify-content: center; padding: 4rem 2rem; text-align: center; background: var(--surface-card); border-radius: 8px; i { font-size: 2rem; margin-bottom: 1rem; } h2 { margin: 0 0 0.5rem; } p { color: var(--text-color-secondary); margin: 0; } }
+.loading-spinner, .denied-icon { width: 64px; height: 64px; display: flex; align-items: center; justify-content: center; border-radius: 50%; margin-bottom: 1rem; }
+.loading-spinner { background: var(--surface-ground); }
+.denied-icon { background: var(--red-100); i { color: var(--red-500); } }
+
+// Main Layout
+.main-content { display: grid; grid-template-columns: 350px 1fr; gap: 1.5rem; }
+
+// Groups Panel
+.groups-panel { background: var(--surface-card); border-radius: 8px; border: 1px solid var(--surface-border); padding: 1rem; height: fit-content; max-height: calc(100vh - 200px); overflow-y: auto; }
+.groups-panel .panel-header { display: flex; justify-content: space-between; align-items: center; margin-bottom: 1rem; padding-bottom: 1rem; border-bottom: 1px solid var(--surface-border); }
+.groups-panel .panel-title { display: flex; align-items: center; gap: 0.5rem; i { color: var(--primary-color); } h2 { margin: 0; font-size: 1rem; } }
+.groups-list { display: flex; flex-direction: column; gap: 0.5rem; }
+
+.group-card { display: flex; align-items: center; gap: 0.75rem; padding: 0.75rem; background: var(--surface-ground); border: 2px solid transparent; border-radius: 8px; cursor: pointer; transition: all 0.2s; }
+.group-card:hover { background: var(--surface-hover); }
+.group-card:hover .group-actions { opacity: 1; }
+.group-card.selected { border-color: var(--primary-color); background: rgba(var(--primary-color-rgb), 0.08); }
+.group-avatar { width: 40px; height: 40px; display: flex; align-items: center; justify-content: center; border-radius: 8px; color: white; font-weight: 600; flex-shrink: 0; }
+.group-info { flex: 1; min-width: 0; h3 { margin: 0; font-size: 0.9rem; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; } .group-id { font-size: 0.75rem; color: var(--text-color-secondary); font-family: monospace; } }
+.group-badges { display: flex; gap: 0.5rem; margin-top: 0.25rem; }
+.badge { padding: 0.15rem 0.4rem; font-size: 0.7rem; border-radius: 4px; }
+.members-badge { background: var(--blue-100); color: var(--blue-700); }
+.roles-badge { background: var(--purple-100); color: var(--purple-700); }
+.group-actions { display: flex; gap: 0.25rem; opacity: 0; transition: opacity 0.2s; .action-btn { width: 28px; height: 28px; } }
+
+// Empty States
+.empty-state, .empty-details { display: flex; flex-direction: column; align-items: center; justify-content: center; padding: 2rem; text-align: center; h3 { margin: 0 0 0.5rem; } p { margin: 0 0 1rem; color: var(--text-color-secondary); } }
+.empty-illustration { width: 64px; height: 64px; display: flex; align-items: center; justify-content: center; background: var(--surface-200); border-radius: 50%; margin-bottom: 1rem; i { font-size: 1.5rem; color: var(--text-color-secondary); } }
+.empty-details { min-height: 300px; }
+.empty-details-content { display: flex; flex-direction: column; align-items: center; }
+
+// Details Panel
+.details-panel { background: var(--surface-card); border-radius: 8px; border: 1px solid var(--surface-border); padding: 1.25rem; height: fit-content; }
+.detail-header { margin-bottom: 1.25rem; padding-bottom: 1.25rem; border-bottom: 1px solid var(--surface-border); }
+.detail-title-row { display: flex; align-items: center; gap: 1rem; margin-bottom: 0.5rem; }
+.detail-avatar { width: 48px; height: 48px; display: flex; align-items: center; justify-content: center; border-radius: 10px; color: white; font-weight: 600; font-size: 1.25rem; }
+.detail-title { h2 { margin: 0; font-size: 1.25rem; } .group-id-code { font-size: 0.8rem; color: var(--text-color-secondary); background: var(--surface-ground); padding: 0.15rem 0.4rem; border-radius: 4px; } }
+.detail-meta { display: flex; gap: 1rem; margin-top: 0.5rem; .meta-item { display: flex; align-items: center; gap: 0.25rem; font-size: 0.85rem; color: var(--text-color-secondary); } }
+.detail-section { margin-bottom: 1.5rem; }
+.section-header { margin-bottom: 0.75rem; }
+.section-title { display: flex; align-items: center; gap: 0.5rem; h3 { margin: 0; font-size: 0.95rem; } i { color: var(--primary-color); } }
+.section-badge { display: inline-flex; align-items: center; justify-content: center; min-width: 20px; height: 20px; padding: 0 6px; background: var(--primary-color); color: white; font-size: 0.7rem; font-weight: 600; border-radius: 10px; }
+
+// Roles & Members
+.roles-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(160px, 1fr)); gap: 0.5rem; }
+.members-grid { display: flex; flex-wrap: wrap; gap: 0.5rem; }
+.role-card { display: flex; align-items: center; gap: 0.5rem; padding: 0.6rem 0.75rem; background: var(--surface-ground); border-radius: 6px; border: 1px solid transparent; }
+.role-card.global-role { background: rgba(99, 102, 241, 0.1); border-color: rgba(99, 102, 241, 0.2); }
+.role-card.scoped-role { background: rgba(34, 197, 94, 0.1); border-color: rgba(34, 197, 94, 0.2); }
+.role-icon { width: 28px; height: 28px; display: flex; align-items: center; justify-content: center; border-radius: 6px; i { font-size: 0.85rem; color: white; } }
+.role-card.global-role .role-icon { background: #6366f1; }
+.role-card.scoped-role .role-icon { background: #22c55e; }
+.role-info { display: flex; flex-direction: column; .role-name { font-weight: 500; font-size: 0.85rem; } .role-scope { font-size: 0.7rem; color: var(--text-color-secondary); } }
+.member-card { display: flex; align-items: center; gap: 0.5rem; padding: 0.5rem 0.75rem; background: var(--surface-ground); border-radius: 6px; }
+.member-card:hover .remove-btn { opacity: 1; }
+.member-avatar { width: 28px; height: 28px; display: flex; align-items: center; justify-content: center; border-radius: 50%; background: var(--primary-color); color: white; font-size: 0.75rem; }
+.member-name { font-size: 0.85rem; }
+.remove-btn { opacity: 0; transition: opacity 0.2s; }
+.empty-roles, .empty-members { padding: 1.5rem; text-align: center; background: var(--surface-ground); border-radius: 6px; color: var(--text-color-secondary); grid-column: 1 / -1; }
+.services-grid { display: flex; flex-wrap: wrap; gap: 0.5rem; }
+.service-tag { padding: 0.3rem 0.6rem; background: var(--surface-ground); border-radius: 12px; font-size: 0.8rem; }
+
+// Dialogs
+.dialog-content { display: flex; flex-direction: column; gap: 1rem; }
+.form-field { display: flex; flex-direction: column; gap: 0.4rem; label { font-weight: 500; font-size: 0.9rem; display: flex; align-items: center; gap: 0.4rem; i { color: var(--primary-color); } } .input-enhanced { border-radius: 6px; } .field-hint { font-size: 0.75rem; color: var(--text-color-secondary); } }
+.add-role-form { padding: 0.75rem; background: var(--surface-ground); border-radius: 6px; .role-selectors { display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap; } }
+.current-roles { display: flex; flex-wrap: wrap; gap: 0.4rem; margin-top: 0.5rem; }
+.role-chip { display: inline-flex; align-items: center; gap: 0.25rem; padding: 0.3rem 0.4rem 0.3rem 0.6rem; border-radius: 6px; font-size: 0.8rem; &.global { background: rgba(99, 102, 241, 0.15); color: #4338ca; } &.scoped { background: rgba(34, 197, 94, 0.15); color: #166534; } .chip-remove { width: 20px; height: 20px; } }
+.no-roles-hint { padding: 0.75rem; background: var(--surface-ground); border-radius: 6px; color: var(--text-color-secondary); font-size: 0.85rem; margin-top: 0.5rem; }
+.member-dialog-header { margin-bottom: 0.5rem; padding: 0.5rem 0.75rem; background: var(--surface-ground); border-radius: 6px; p { margin: 0; font-size: 0.85rem; } }
+.dialog-footer { display: flex; justify-content: flex-end; gap: 0.5rem; }
+
+// PrimeNG Dialog Footer Override
+::ng-deep .p-dialog {
+  .p-dialog-footer {
+    display: flex;
+    justify-content: flex-end;
+    gap: 0.5rem;
+    padding: 1rem 1.5rem;
+    border-top: 1px solid var(--surface-border);
+  }
+}
+
+// Responsive
+@media (max-width: 992px) { .admin-permissions-container { padding: 1rem; } .page-header { flex-direction: column; gap: 1rem; .header-content { flex-direction: column; text-align: center; } } .main-content { grid-template-columns: 1fr; } .groups-panel { max-height: none; } }
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.spec.ts b/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.spec.ts
new file mode 100644
index 00000000000..12cde34ea4d
--- /dev/null
+++ b/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.spec.ts
@@ -0,0 +1,456 @@
+import { ComponentFixture, TestBed, fakeAsync, tick } from '@angular/core/testing';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { FormsModule } from '@angular/forms';
+import { of, throwError } from 'rxjs';
+import { NO_ERRORS_SCHEMA } from '@angular/core';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
+
+import { AdminPermissionsPageComponent } from './admin-permissions-page.component';
+import { PermissionsService } from 'src/app/_services/permissions/permissions.service';
+import { UserProfileService } from 'src/app/_services/user-profile/user-profile.service';
+import { ConfirmationService, MessageService } from 'primeng/api';
+import { SelectModule } from 'primeng/select';
+import { SelectButtonModule } from 'primeng/selectbutton';
+import { AutoCompleteModule } from 'primeng/autocomplete';
+import { 
+    AddMembersResult,
+    EffectivePermissions, 
+    GlobalRole, 
+    GroupPermissions, 
+    LanguageScopedRole 
+} from 'src/app/_models/permissions';
+import { UserProfile } from 'src/app/_models/userProfile';
+
+describe('AdminPermissionsPageComponent', () => {
+    let component: AdminPermissionsPageComponent;
+    let fixture: ComponentFixture<AdminPermissionsPageComponent>;
+    let permissionsServiceSpy: jasmine.SpyObj<PermissionsService>;
+    let userProfileServiceSpy: jasmine.SpyObj<UserProfileService>;
+    let messageServiceSpy: jasmine.SpyObj<MessageService>;
+    let confirmationServiceSpy: jasmine.SpyObj<ConfirmationService>;
+
+    const mockAdminPermissions: EffectivePermissions = {
+        userId: 'adminUser',
+        roles: [{ kind: 'global', role: GlobalRole.Admin }]
+    };
+
+    const mockNonAdminPermissions: EffectivePermissions = {
+        userId: 'regularUser',
+        roles: [{ kind: 'global', role: GlobalRole.ServiceTeam }]
+    };
+
+    const mockUserProfile: UserProfile = {
+        userName: 'adminUser',
+        email: 'admin@test.com',
+        languages: [],
+        preferences: {
+            userName: 'adminUser',
+            theme: 'light-theme',
+            hideLineNumbers: false,
+            hideLeftNavigation: false,
+            showHiddenApis: false,
+            hideReviewPageOptions: false,
+            hideSamplesPageOptions: false,
+            showDocumentation: true,
+            showComments: true,
+            showSystemComments: true,
+            disableCodeLinesLazyLoading: false,
+            language: [],
+            approvedLanguages: []
+        },
+        permissions: mockAdminPermissions
+    };
+
+    const mockGroups: GroupPermissions[] = [
+        {
+            id: 'group-admins',
+            type: 'group',
+            groupId: 'admins',
+            groupName: 'Administrators',
+            roles: [{ kind: 'global', role: GlobalRole.Admin }],
+            members: ['user1', 'user2'],
+            lastUpdatedOn: '2026-01-07T00:00:00Z',
+            lastUpdatedBy: 'system',
+            serviceNames: []
+        },
+        {
+            id: 'group-python-architects',
+            type: 'group',
+            groupId: 'python-architects',
+            groupName: 'Python Architects',
+            roles: [{ kind: 'scoped', role: LanguageScopedRole.Architect, language: 'Python' }],
+            members: ['pythonDev1'],
+            lastUpdatedOn: '2026-01-07T00:00:00Z',
+            lastUpdatedBy: 'system',
+            serviceNames: ['azure-sdk-for-python']
+        }
+    ];
+
+    beforeEach(async () => {
+        const permissionsSpy = jasmine.createSpyObj('PermissionsService', [
+            'isAdmin', 
+            'getAllGroups', 
+            'createGroup', 
+            'updateGroup', 
+            'deleteGroup',
+            'addMembersToGroup',
+            'removeMemberFromGroup',
+            'getAllUsernames'
+        ]);
+        const userProfileSpy = jasmine.createSpyObj('UserProfileService', ['getUserProfile']);
+        const messageSpy = jasmine.createSpyObj('MessageService', ['add']);
+        const confirmationSpy = jasmine.createSpyObj('ConfirmationService', ['confirm']);
+
+        await TestBed.configureTestingModule({
+            declarations: [AdminPermissionsPageComponent],
+            imports: [
+                HttpClientTestingModule, 
+                FormsModule,
+                BrowserAnimationsModule,
+                SelectModule,
+                SelectButtonModule,
+                AutoCompleteModule
+            ],
+            providers: [
+                { provide: PermissionsService, useValue: permissionsSpy },
+                { provide: UserProfileService, useValue: userProfileSpy },
+                { provide: MessageService, useValue: messageSpy },
+                { provide: ConfirmationService, useValue: confirmationSpy }
+            ],
+            schemas: [NO_ERRORS_SCHEMA]
+        }).compileComponents();
+
+        fixture = TestBed.createComponent(AdminPermissionsPageComponent);
+        component = fixture.componentInstance;
+        permissionsServiceSpy = TestBed.inject(PermissionsService) as jasmine.SpyObj<PermissionsService>;
+        userProfileServiceSpy = TestBed.inject(UserProfileService) as jasmine.SpyObj<UserProfileService>;
+        messageServiceSpy = TestBed.inject(MessageService) as jasmine.SpyObj<MessageService>;
+        confirmationServiceSpy = TestBed.inject(ConfirmationService) as jasmine.SpyObj<ConfirmationService>;
+
+        // Default mock for getAllUsernames - called during component initialization
+        permissionsServiceSpy.getAllUsernames.and.returnValue(of(['user1', 'user2', 'pythonDev1', 'newUser']));
+    });
+
+    describe('Initialization', () => {
+        it('should create', () => {
+            userProfileServiceSpy.getUserProfile.and.returnValue(of(mockUserProfile));
+            permissionsServiceSpy.isAdmin.and.returnValue(true);
+            permissionsServiceSpy.getAllGroups.and.returnValue(of(mockGroups));
+            
+            fixture.detectChanges();
+            
+            expect(component).toBeTruthy();
+        });
+
+        it('should load groups when user is admin', fakeAsync(() => {
+            userProfileServiceSpy.getUserProfile.and.returnValue(of(mockUserProfile));
+            permissionsServiceSpy.isAdmin.and.returnValue(true);
+            permissionsServiceSpy.getAllGroups.and.returnValue(of(mockGroups));
+
+            fixture.detectChanges();
+            tick();
+
+            expect(component.isAdmin).toBeTrue();
+            expect(component.groups.length).toBe(2);
+            expect(component.isLoading).toBeFalse();
+        }));
+
+        it('should not load groups when user is not admin', fakeAsync(() => {
+            const nonAdminProfile = { ...mockUserProfile, permissions: mockNonAdminPermissions };
+            userProfileServiceSpy.getUserProfile.and.returnValue(of(nonAdminProfile));
+            permissionsServiceSpy.isAdmin.and.returnValue(false);
+
+            fixture.detectChanges();
+            tick();
+
+            expect(component.isAdmin).toBeFalse();
+            expect(component.groups.length).toBe(0);
+            expect(permissionsServiceSpy.getAllGroups).not.toHaveBeenCalled();
+        }));
+
+        it('should handle error when loading user profile', fakeAsync(() => {
+            userProfileServiceSpy.getUserProfile.and.returnValue(throwError(() => new Error('Failed')));
+
+            fixture.detectChanges();
+            tick();
+
+            expect(component.isLoading).toBeFalse();
+            expect(messageServiceSpy.add).toHaveBeenCalledWith(jasmine.objectContaining({
+                severity: 'error',
+                summary: 'Error'
+            }));
+        }));
+    });
+
+    describe('Group Selection', () => {
+        beforeEach(() => {
+            userProfileServiceSpy.getUserProfile.and.returnValue(of(mockUserProfile));
+            permissionsServiceSpy.isAdmin.and.returnValue(true);
+            permissionsServiceSpy.getAllGroups.and.returnValue(of(mockGroups));
+            fixture.detectChanges();
+        });
+
+        it('should select a group when clicked', () => {
+            component.selectGroup(mockGroups[0]);
+            
+            expect(component.selectedGroup).toEqual(mockGroups[0]);
+        });
+
+        it('should update selected group when a different group is clicked', () => {
+            component.selectGroup(mockGroups[0]);
+            component.selectGroup(mockGroups[1]);
+            
+            expect(component.selectedGroup).toEqual(mockGroups[1]);
+        });
+    });
+
+    describe('Role Management', () => {
+        beforeEach(() => {
+            userProfileServiceSpy.getUserProfile.and.returnValue(of(mockUserProfile));
+            permissionsServiceSpy.isAdmin.and.returnValue(true);
+            permissionsServiceSpy.getAllGroups.and.returnValue(of(mockGroups));
+            fixture.detectChanges();
+            component.openCreateGroupDialog();
+        });
+
+        it('should add global role to form', () => {
+            component.newRoleKind = 'global';
+            component.newGlobalRole = GlobalRole.Admin;
+            
+            component.addRoleToForm();
+            
+            expect(component.groupForm.roles.length).toBe(1);
+            expect(component.groupForm.roles[0].kind).toBe('global');
+        });
+
+        it('should add scoped role to form', () => {
+            component.newRoleKind = 'scoped';
+            component.newScopedRole = LanguageScopedRole.Architect;
+            component.newRoleLanguage = 'Python';
+            
+            component.addRoleToForm();
+            
+            expect(component.groupForm.roles.length).toBe(1);
+            expect(component.groupForm.roles[0].kind).toBe('scoped');
+        });
+
+        it('should prevent adding duplicate global role', () => {
+            component.newRoleKind = 'global';
+            component.newGlobalRole = GlobalRole.Admin;
+            
+            component.addRoleToForm();
+            component.addRoleToForm();
+            
+            expect(component.groupForm.roles.length).toBe(1);
+            expect(messageServiceSpy.add).toHaveBeenCalledWith(jasmine.objectContaining({
+                severity: 'warn'
+            }));
+        });
+
+        it('should prevent adding duplicate scoped role', () => {
+            component.newRoleKind = 'scoped';
+            component.newScopedRole = LanguageScopedRole.Architect;
+            component.newRoleLanguage = 'Python';
+            
+            component.addRoleToForm();
+            component.addRoleToForm();
+            
+            expect(component.groupForm.roles.length).toBe(1);
+        });
+
+        it('should remove role from form', () => {
+            component.newRoleKind = 'global';
+            component.newGlobalRole = GlobalRole.Admin;
+            component.addRoleToForm();
+            
+            component.removeRoleFromForm(0);
+            
+            expect(component.groupForm.roles.length).toBe(0);
+        });
+    });
+
+    describe('Group CRUD Operations', () => {
+        beforeEach(() => {
+            userProfileServiceSpy.getUserProfile.and.returnValue(of(mockUserProfile));
+            permissionsServiceSpy.isAdmin.and.returnValue(true);
+            permissionsServiceSpy.getAllGroups.and.returnValue(of(mockGroups));
+            fixture.detectChanges();
+        });
+
+        it('should open create group dialog with empty form', () => {
+            component.openCreateGroupDialog();
+            
+            expect(component.showGroupDialog).toBeTrue();
+            expect(component.isEditMode).toBeFalse();
+            expect(component.groupForm.groupId).toBe('');
+            expect(component.groupForm.groupName).toBe('');
+        });
+
+        it('should open edit group dialog with group data', () => {
+            component.openEditGroupDialog(mockGroups[0]);
+            
+            expect(component.showGroupDialog).toBeTrue();
+            expect(component.isEditMode).toBeTrue();
+            expect(component.groupForm.groupId).toBe('admins');
+            expect(component.groupForm.groupName).toBe('Administrators');
+        });
+
+        it('should create group successfully', fakeAsync(() => {
+            const newGroup: GroupPermissions = {
+                id: 'group-new',
+                type: 'group',
+                groupId: 'new-group',
+                groupName: 'New Group',
+                roles: [],
+                members: [],
+                lastUpdatedOn: '2026-01-07T00:00:00Z',
+                lastUpdatedBy: 'adminUser',
+                serviceNames: []
+            };
+            permissionsServiceSpy.createGroup.and.returnValue(of(newGroup));
+            
+            component.openCreateGroupDialog();
+            component.groupForm.groupId = 'new-group';
+            component.groupForm.groupName = 'New Group';
+            
+            component.saveGroup();
+            tick();
+            
+            expect(permissionsServiceSpy.createGroup).toHaveBeenCalled();
+            expect(messageServiceSpy.add).toHaveBeenCalledWith(jasmine.objectContaining({
+                severity: 'success'
+            }));
+        }));
+
+        it('should update group successfully', fakeAsync(() => {
+            permissionsServiceSpy.updateGroup.and.returnValue(of(mockGroups[0]));
+            
+            component.openEditGroupDialog(mockGroups[0]);
+            component.groupForm.groupName = 'Updated Name';
+            
+            component.saveGroup();
+            tick();
+            
+            expect(permissionsServiceSpy.updateGroup).toHaveBeenCalledWith(
+                'admins',
+                jasmine.objectContaining({ groupName: 'Updated Name' })
+            );
+        }));
+
+        it('should delete group after confirmation', fakeAsync(() => {
+            confirmationServiceSpy.confirm.and.callFake((config: any) => {
+                config.accept();
+                return confirmationServiceSpy;
+            });
+            permissionsServiceSpy.deleteGroup.and.returnValue(of(void 0));
+            
+            component.deleteGroup(mockGroups[0]);
+            tick();
+            
+            expect(permissionsServiceSpy.deleteGroup).toHaveBeenCalledWith('admins');
+        }));
+
+        it('should not delete group when confirmation is cancelled', () => {
+            confirmationServiceSpy.confirm.and.callFake((config: any) => {
+                // Do nothing - simulates user clicking cancel
+                return confirmationServiceSpy;
+            });
+            
+            component.deleteGroup(mockGroups[0]);
+            
+            expect(permissionsServiceSpy.deleteGroup).not.toHaveBeenCalled();
+        });
+    });
+
+    describe('Member Management', () => {
+        beforeEach(() => {
+            userProfileServiceSpy.getUserProfile.and.returnValue(of(mockUserProfile));
+            permissionsServiceSpy.isAdmin.and.returnValue(true);
+            permissionsServiceSpy.getAllGroups.and.returnValue(of(mockGroups));
+            fixture.detectChanges();
+            component.selectGroup(mockGroups[0]);
+        });
+
+        it('should open add member dialog', () => {
+            component.openAddMemberDialog();
+            
+            expect(component.showAddMemberDialog).toBeTrue();
+            expect(component.newMemberUsernames).toEqual([]);
+        });
+
+        it('should add member successfully', fakeAsync(() => {
+            const mockResult: AddMembersResult = { addedUsers: ['newUser'], invalidUsers: [], allUsersValid: true };
+            permissionsServiceSpy.addMembersToGroup.and.returnValue(of(mockResult));
+            permissionsServiceSpy.getAllGroups.and.returnValue(of(mockGroups));
+            
+            component.openAddMemberDialog();
+            component.newMemberUsernames = ['newUser'];
+            component.addMembers();
+            tick();
+            
+            expect(permissionsServiceSpy.addMembersToGroup).toHaveBeenCalledWith('admins', ['newUser']);
+            expect(messageServiceSpy.add).toHaveBeenCalledWith(jasmine.objectContaining({
+                severity: 'success'
+            }));
+        }));
+
+        it('should not add member with empty usernames', () => {
+            component.openAddMemberDialog();
+            component.newMemberUsernames = [];
+            component.addMembers();
+            
+            expect(permissionsServiceSpy.addMembersToGroup).not.toHaveBeenCalled();
+        });
+
+        it('should remove member after confirmation', fakeAsync(() => {
+            confirmationServiceSpy.confirm.and.callFake((config: any) => {
+                config.accept();
+                return confirmationServiceSpy;
+            });
+            permissionsServiceSpy.removeMemberFromGroup.and.returnValue(of(void 0));
+            permissionsServiceSpy.getAllGroups.and.returnValue(of(mockGroups));
+            
+            component.removeMember('user1');
+            tick();
+            
+            expect(permissionsServiceSpy.removeMemberFromGroup).toHaveBeenCalledWith('admins', 'user1');
+        }));
+    });
+
+    describe('Helper Methods', () => {
+        beforeEach(() => {
+            userProfileServiceSpy.getUserProfile.and.returnValue(of(mockUserProfile));
+            permissionsServiceSpy.isAdmin.and.returnValue(true);
+            permissionsServiceSpy.getAllGroups.and.returnValue(of(mockGroups));
+            fixture.detectChanges();
+        });
+
+        it('should calculate total members correctly', () => {
+            expect(component.getTotalMembers()).toBe(3); // 2 + 1 from mock groups
+        });
+
+        it('should format role display name for global role', () => {
+            const role = { kind: 'global' as const, role: GlobalRole.Admin };
+            const displayName = component.getRoleDisplayName(role);
+            
+            expect(displayName).toContain('Admin');
+            expect(displayName).toContain('Global');
+        });
+
+        it('should format role display name for scoped role', () => {
+            const role = { kind: 'scoped' as const, role: LanguageScopedRole.Architect, language: 'Python' };
+            const displayName = component.getRoleDisplayName(role);
+            
+            expect(displayName).toContain('Architect');
+            expect(displayName).toContain('Python');
+        });
+
+        it('should format date correctly', () => {
+            const dateString = '2026-01-07T10:30:00Z';
+            const formatted = component.formatDate(dateString);
+            
+            expect(formatted).toContain('Jan');
+            expect(formatted).toContain('2026');
+        });
+    });
+});
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.ts b/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.ts
new file mode 100644
index 00000000000..4d832b738fe
--- /dev/null
+++ b/src/dotnet/APIView/ClientSPA/src/app/_components/admin-permissions-page/admin-permissions-page.component.ts
@@ -0,0 +1,433 @@
+import { Component, OnInit } from '@angular/core';
+import { ConfirmationService, MessageService } from 'primeng/api';
+import { 
+    EffectivePermissions, 
+    GlobalRole, 
+    GroupPermissions, 
+    GroupPermissionsRequest, 
+    LanguageScopedRole, 
+    RoleAssignment,
+    SUPPORTED_LANGUAGES,
+    GLOBAL_ROLE_OPTIONS,
+    LANGUAGE_SCOPED_ROLE_OPTIONS,
+    formatRoleName as formatRoleNameFn
+} from 'src/app/_models/permissions';
+import { PermissionsService } from 'src/app/_services/permissions/permissions.service';
+import { UserProfileService } from 'src/app/_services/user-profile/user-profile.service';
+import { UserProfile } from 'src/app/_models/userProfile';
+import { AutoCompleteCompleteEvent } from 'primeng/autocomplete';
+
+interface GroupFormData {
+    groupId: string;
+    groupName: string;
+    roles: RoleAssignment[];
+    serviceNames: string[];
+}
+
+@Component({
+    selector: 'app-admin-permissions-page',
+    templateUrl: './admin-permissions-page.component.html',
+    styleUrls: ['./admin-permissions-page.component.scss'],
+    standalone: false
+})
+export class AdminPermissionsPageComponent implements OnInit {
+    currentUserPermissions: EffectivePermissions | null = null;
+    isAdmin: boolean = false;
+    isLoading: boolean = true;
+
+    groups: GroupPermissions[] = [];
+    selectedGroup: GroupPermissions | null = null;
+
+    showGroupDialog: boolean = false;
+    showAddMemberDialog: boolean = false;
+    isEditMode: boolean = false;
+
+    groupForm: GroupFormData = this.getEmptyGroupForm();
+    newMemberUsernames: string[] = [];
+    userSuggestions: string[] = [];
+    allUsers: string[] = []; 
+
+    globalRoleOptions = GLOBAL_ROLE_OPTIONS;
+    languageScopedRoleOptions = LANGUAGE_SCOPED_ROLE_OPTIONS;
+    languageOptions = SUPPORTED_LANGUAGES;
+
+    newRoleKind: 'global' | 'scoped' = 'global';
+    newGlobalRole: GlobalRole = GlobalRole.ServiceTeam;
+    newScopedRole: LanguageScopedRole = LanguageScopedRole.Architect;
+    newRoleLanguage: string = 'Python';
+
+    private readonly defaultGroupId = 'azure-sdk-team';
+
+    constructor(
+        private permissionsService: PermissionsService,
+        private userProfileService: UserProfileService,
+        private messageService: MessageService,
+        private confirmationService: ConfirmationService
+    ) {}
+
+    ngOnInit(): void {
+        this.loadCurrentUserPermissions();
+    }
+
+    private loadCurrentUserPermissions(): void {
+        this.userProfileService.getUserProfile().subscribe({
+            next: (userProfile: UserProfile) => {
+                this.currentUserPermissions = userProfile.permissions;
+                this.isAdmin = this.permissionsService.isAdmin(this.currentUserPermissions);
+                
+                if (this.isAdmin) {
+                    this.loadGroups();
+                } else {
+                    this.isLoading = false;
+                }
+            },
+            error: (err) => {
+                this.isLoading = false;
+                this.messageService.add({
+                    severity: 'error',
+                    summary: 'Error',
+                    detail: 'Failed to load user permissions'
+                });
+            }
+        });
+    }
+
+    private loadGroups(): void {
+        this.isLoading = true;
+        this.permissionsService.getAllGroups().subscribe({
+            next: (groups) => {
+                this.groups = groups;
+                
+                if (!this.selectedGroup) {
+                    const defaultGroup = groups.find(g => g.groupId === this.defaultGroupId);
+                    if (defaultGroup) {
+                        this.selectedGroup = defaultGroup;
+                    }
+                }
+                
+                this.loadAllUsers();
+            },
+            error: (err) => {
+                this.isLoading = false;
+                this.messageService.add({
+                    severity: 'error',
+                    summary: 'Error',
+                    detail: 'Failed to load groups'
+                });
+            }
+        });
+    }
+
+    private loadAllUsers(): void {
+        this.permissionsService.getAllUsernames().subscribe({
+            next: (users) => {
+                this.allUsers = users;
+                this.isLoading = false;
+            },
+            error: (err) => {
+                this.allUsers = [];
+                this.isLoading = false;
+            }
+        });
+    }
+
+    private getEmptyGroupForm(): GroupFormData {
+        return {
+            groupId: '',
+            groupName: '',
+            roles: [],
+            serviceNames: []
+        };
+    }
+
+    openCreateGroupDialog(): void {
+        this.isEditMode = false;
+        this.groupForm = this.getEmptyGroupForm();
+        this.showGroupDialog = true;
+    }
+
+    openEditGroupDialog(group: GroupPermissions): void {
+        this.isEditMode = true;
+        this.groupForm = {
+            groupId: group.groupId,
+            groupName: group.groupName,
+            roles: [...group.roles],
+            serviceNames: [...group.serviceNames]
+        };
+        this.showGroupDialog = true;
+    }
+
+    saveGroup(): void {
+        const request: GroupPermissionsRequest = {
+            groupId: this.groupForm.groupId,
+            groupName: this.groupForm.groupName,
+            roles: this.groupForm.roles,
+            serviceNames: this.groupForm.serviceNames
+        };
+
+        if (this.isEditMode) {
+            this.permissionsService.updateGroup(this.groupForm.groupId, request).subscribe({
+                next: () => {
+                    this.messageService.add({
+                        severity: 'success',
+                        summary: 'Success',
+                        detail: 'Group updated successfully'
+                    });
+                    this.showGroupDialog = false;
+                    this.loadGroups();
+                },
+                error: (err) => {
+                    this.messageService.add({
+                        severity: 'error',
+                        summary: 'Error',
+                        detail: 'Failed to update group'
+                    });
+                }
+            });
+        } else {
+            this.permissionsService.createGroup(request).subscribe({
+                next: () => {
+                    this.messageService.add({
+                        severity: 'success',
+                        summary: 'Success',
+                        detail: 'Group created successfully'
+                    });
+                    this.showGroupDialog = false;
+                    this.loadGroups();
+                },
+                error: (err) => {
+                    this.messageService.add({
+                        severity: 'error',
+                        summary: 'Error',
+                        detail: 'Failed to create group'
+                    });
+                }
+            });
+        }
+    }
+
+    deleteGroup(group: GroupPermissions): void {
+        this.confirmationService.confirm({
+            message: `Are you sure you want to delete the group "${group.groupName}"?`,
+            header: 'Delete Group',
+            icon: 'pi pi-exclamation-triangle',
+            acceptButtonStyleClass: 'p-button-danger',
+            accept: () => {
+                this.permissionsService.deleteGroup(group.groupId).subscribe({
+                    next: () => {
+                        this.messageService.add({
+                            severity: 'success',
+                            summary: 'Success',
+                            detail: 'Group deleted successfully'
+                        });
+                        this.loadGroups();
+                    },
+                    error: (err) => {
+                        this.messageService.add({
+                            severity: 'error',
+                            summary: 'Error',
+                            detail: 'Failed to delete group'
+                        });
+                    }
+                });
+            }
+        });
+    }
+
+    addRoleToForm(): void {
+        let newRole: RoleAssignment;
+        
+        if (this.newRoleKind === 'global') {
+            newRole = {
+                kind: 'global',
+                role: this.newGlobalRole
+            };
+        } else {
+            newRole = {
+                kind: 'scoped',
+                role: this.newScopedRole,
+                language: this.newRoleLanguage
+            };
+        }
+
+        // Check for duplicates
+        const isDuplicate = this.groupForm.roles.some(r => {
+            if (r.kind !== newRole.kind) return false;
+            if (r.kind === 'global' && newRole.kind === 'global') {
+                return r.role === newRole.role;
+            }
+            if (r.kind === 'scoped' && newRole.kind === 'scoped') {
+                return r.role === newRole.role && r.language === newRole.language;
+            }
+            return false;
+        });
+
+        if (isDuplicate) {
+            this.messageService.add({
+                severity: 'warn',
+                summary: 'Warning',
+                detail: 'This role already exists in the group'
+            });
+            return;
+        }
+
+        this.groupForm.roles.push(newRole);
+    }
+
+    removeRoleFromForm(index: number): void {
+        this.groupForm.roles.splice(index, 1);
+    }
+
+    getRoleDisplayName(role: RoleAssignment): string {
+        const roleName = formatRoleNameFn(role.role);
+        if (role.kind === 'global') {
+            return `${roleName} (Global)`;
+        } else {
+            return `${roleName} - ${role.language}`;
+        }
+    }
+
+    // Wrapper for template access to shared formatRoleName function
+    formatRoleName(role: string): string {
+        return formatRoleNameFn(role);
+    }
+
+    selectGroup(group: GroupPermissions): void {
+        this.selectedGroup = group;
+    }
+
+    openAddMemberDialog(): void {
+        this.newMemberUsernames = [];
+        this.userSuggestions = [];
+        this.showAddMemberDialog = true;
+    }
+
+    searchUsers(event: AutoCompleteCompleteEvent): void {
+        const query = (event.query || '').toLowerCase();
+        
+        const existingMembers = new Set(this.selectedGroup?.members || []);
+        const alreadySelected = new Set(this.newMemberUsernames);
+        
+        this.userSuggestions = this.allUsers.filter(u => {
+            if (existingMembers.has(u) || alreadySelected.has(u)) {
+                return false;
+            }
+            return u.toLowerCase().startsWith(query);
+        }).slice(0, 20); 
+    }
+
+    addMembers(): void {
+        if (!this.selectedGroup || this.newMemberUsernames.length === 0) return;
+
+        const groupId = this.selectedGroup.groupId;
+        const usernames = this.newMemberUsernames.map(u => u.trim()).filter(u => u.length > 0);
+        
+        if (usernames.length === 0) return;
+
+        this.permissionsService.addMembersToGroup(groupId, usernames).subscribe({
+            next: (result) => {
+                if (result.addedUsers.length > 0) {
+                    const memberText = result.addedUsers.length === 1 
+                        ? `Member "${result.addedUsers[0]}"` 
+                        : `${result.addedUsers.length} members`;
+                    this.messageService.add({
+                        severity: 'success',
+                        summary: 'Success',
+                        detail: `${memberText} added successfully`
+                    });
+                }
+
+                if (result.invalidUsers.length > 0) {
+                    const invalidText = result.invalidUsers.join(', ');
+                    this.messageService.add({
+                        severity: 'warn',
+                        summary: 'Users Not Found',
+                        detail: `The following users don't exist in our database and were not added: ${invalidText}`,
+                        sticky: true
+                    });
+                }
+
+                this.showAddMemberDialog = false;
+                this.refreshGroupsAndReselect(groupId);
+            },
+            error: (err) => {
+                this.messageService.add({
+                    severity: 'error',
+                    summary: 'Error',
+                    detail: err.error?.message || 'Failed to add members'
+                });
+            }
+        });
+    }
+
+    removeMember(userId: string): void {
+        if (!this.selectedGroup) return;
+
+        const groupId = this.selectedGroup.groupId;
+        this.confirmationService.confirm({
+            message: `Are you sure you want to remove "${userId}" from this group?`,
+            header: 'Remove Member',
+            icon: 'pi pi-exclamation-triangle',
+            acceptButtonStyleClass: 'p-button-danger',
+            accept: () => {
+                this.permissionsService.removeMemberFromGroup(groupId, userId).subscribe({
+                    next: () => {
+                        this.messageService.add({
+                            severity: 'success',
+                            summary: 'Success',
+                            detail: `Member "${userId}" removed successfully`
+                        });
+                        this.refreshGroupsAndReselect(groupId);
+                    },
+                    error: (err) => {
+                        this.messageService.add({
+                            severity: 'error',
+                            summary: 'Error',
+                            detail: 'Failed to remove member'
+                        });
+                    }
+                });
+            }
+        });
+    }
+
+    private refreshGroupsAndReselect(groupId: string): void {
+        this.permissionsService.getAllGroups().subscribe({
+            next: (groups) => {
+                this.groups = groups;
+                this.selectedGroup = groups.find(g => g.groupId === groupId) || null;
+            },
+            error: (err) => {
+                this.messageService.add({
+                    severity: 'error',
+                    summary: 'Error',
+                    detail: 'Failed to refresh groups'
+                });
+            }
+        });
+    }
+
+    // ===== Helper Methods =====
+    private avatarColors = [
+        '#6366f1', '#8b5cf6', '#ec4899', '#f43f5e', '#f97316',
+        '#eab308', '#22c55e', '#14b8a6', '#06b6d4', '#3b82f6'
+    ];
+
+    getGroupColor(index: number): string {
+        return this.avatarColors[index % this.avatarColors.length];
+    }
+
+    getTotalMembers(): number {
+        return this.groups.reduce((total, group) => total + group.members.length, 0);
+    }
+
+    formatDate(dateString: string): string {
+        return new Date(dateString).toLocaleDateString('en-US', {
+            year: 'numeric',
+            month: 'short',
+            day: 'numeric',
+            hour: '2-digit',
+            minute: '2-digit'
+        });
+    }
+}
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_components/review-page/review-page.component.ts b/src/dotnet/APIView/ClientSPA/src/app/_components/review-page/review-page.component.ts
index d4f0415bf87..016f2de4157 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/_components/review-page/review-page.component.ts
+++ b/src/dotnet/APIView/ClientSPA/src/app/_components/review-page/review-page.component.ts
@@ -544,7 +544,8 @@ export class ReviewPageComponent implements OnInit {
           userName: this.userProfile!.userName,
           email: this.userProfile!.email,
           languages: this.userProfile!.languages,
-          preferences: this.userProfile!.preferences
+          preferences: this.userProfile!.preferences,
+          permissions: this.userProfile!.permissions
         };
         this.userProfile = userProfile;
       }
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_components/samples-page/samples-page.component.ts b/src/dotnet/APIView/ClientSPA/src/app/_components/samples-page/samples-page.component.ts
index 90bf4fcc782..8380f0a1cbc 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/_components/samples-page/samples-page.component.ts
+++ b/src/dotnet/APIView/ClientSPA/src/app/_components/samples-page/samples-page.component.ts
@@ -407,7 +407,8 @@ export class SamplesPageComponent {
           userName: this.userProfile!.userName,
           email: this.userProfile!.email,
           languages: this.userProfile!.languages,
-          preferences: this.userProfile!.preferences
+          preferences: this.userProfile!.preferences,
+          permissions: this.userProfile!.permissions
         };
         this.userProfile = userProfile;
       }
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.html b/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.html
index cc019adfaaf..b04d892ac69 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.html
+++ b/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.html
@@ -7,6 +7,7 @@
         </button>
         <div class="navbar-collapse collapse">
             <ul class="navbar-nav ms-auto align-items-center">
+
                 <!-- Requested Reviews link (for approvers) -->
                 <li *ngIf="isLoggedIn && isApprover" class="nav-item">
                     <a href="{{RequestReviewPageUrl}}" class="nav-link nav-btn">
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.spec.ts b/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.spec.ts
index 8e713bfb135..e5d2bc2101d 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.spec.ts
+++ b/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.spec.ts
@@ -5,12 +5,59 @@ import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { ActivatedRoute, convertToParamMap, provideRouter } from '@angular/router';
 import { NO_ERRORS_SCHEMA } from '@angular/core';
 import { of } from 'rxjs';
+import { PermissionsService } from 'src/app/_services/permissions/permissions.service';
+import { AuthService } from 'src/app/_services/auth/auth.service';
+import { UserProfileService } from 'src/app/_services/user-profile/user-profile.service';
+import { ConfigService } from 'src/app/_services/config/config.service';
+import { NotificationsService } from 'src/app/_services/notifications/notifications.service';
+import { EffectivePermissions, GlobalRole, GlobalRoleAssignment } from 'src/app/_models/permissions';
+import { UserProfile } from 'src/app/_models/userProfile';
+import { UserPreferenceModel } from 'src/app/_models/userPreferenceModel';
 
 describe('NavBarComponent', () => {
   let component: NavBarComponent;
   let fixture: ComponentFixture<NavBarComponent>;
+  let mockPermissionsService: jasmine.SpyObj<PermissionsService>;
+  let mockAuthService: jasmine.SpyObj<AuthService>;
+  let mockUserProfileService: jasmine.SpyObj<UserProfileService>;
+  let mockNotificationsService: jasmine.SpyObj<NotificationsService>;
+  let mockConfigService: jasmine.SpyObj<ConfigService>;
+
+  const mockUserProfile: UserProfile = {
+    userName: 'testuser',
+    email: 'test@example.com',
+    languages: [],
+    preferences: new UserPreferenceModel(),
+    permissions: null
+  };
+
+  const mockPermissions: EffectivePermissions = {
+    userId: 'testuser',
+    roles: []
+  };
+
+  const mockAdminPermissions: EffectivePermissions = {
+    userId: 'testuser',
+    roles: [{ kind: 'global', role: GlobalRole.Admin } as GlobalRoleAssignment]
+  };
 
   beforeEach(() => {
+    mockPermissionsService = jasmine.createSpyObj('PermissionsService', ['getMyPermissions', 'isAdmin']);
+    mockAuthService = jasmine.createSpyObj('AuthService', ['isLoggedIn']);
+    mockUserProfileService = jasmine.createSpyObj('UserProfileService', ['getUserProfile', 'updateUserProfile']);
+    mockNotificationsService = jasmine.createSpyObj('NotificationsService', ['clearNotification', 'clearAll'], {
+      notifications$: of([])
+    });
+    mockConfigService = jasmine.createSpyObj('ConfigService', [], {
+      webAppUrl: 'http://localhost/',
+      apiUrl: '/api'
+    });
+
+    mockAuthService.isLoggedIn.and.returnValue(of(true));
+    mockUserProfileService.getUserProfile.and.returnValue(of(mockUserProfile));
+    mockPermissionsService.getMyPermissions.and.returnValue(of(mockPermissions));
+    mockPermissionsService.isAdmin.and.returnValue(false);
+
     TestBed.configureTestingModule({
       imports: [
         NavBarComponent,
@@ -27,6 +74,11 @@ describe('NavBarComponent', () => {
             queryParams: of(convertToParamMap({ activeApiRevisionId: 'test', diffApiRevisionId: 'test' }))
           },
         },
+        { provide: PermissionsService, useValue: mockPermissionsService },
+        { provide: AuthService, useValue: mockAuthService },
+        { provide: UserProfileService, useValue: mockUserProfileService },
+        { provide: NotificationsService, useValue: mockNotificationsService },
+        { provide: ConfigService, useValue: mockConfigService }
       ]
     });
     fixture = TestBed.createComponent(NavBarComponent);
@@ -37,4 +89,45 @@ describe('NavBarComponent', () => {
   it('should create', () => {
     expect(component).toBeTruthy();
   });
+
+  describe('isAdmin', () => {
+    it('should set isAdmin to false when user has no admin role', () => {
+      mockPermissionsService.isAdmin.and.returnValue(false);
+      expect(component.isAdmin).toBeFalse();
+    });
+
+    it('should set isAdmin to true when user has admin role', () => {
+      mockPermissionsService.isAdmin.and.returnValue(true);
+
+      const profileWithPermissions: UserProfile = {
+        ...mockUserProfile,
+        permissions: mockAdminPermissions
+      };
+      mockUserProfileService.getUserProfile.and.returnValue(of(profileWithPermissions));
+
+      // Recreate component to pick up new mock values
+      fixture = TestBed.createComponent(NavBarComponent);
+      component = fixture.componentInstance;
+      fixture.detectChanges();
+
+      expect(component.isAdmin).toBeTrue();
+    });
+
+    it('should fetch permissions from service when not on userProfile', () => {
+      mockPermissionsService.isAdmin.and.returnValue(false);
+      mockPermissionsService.getMyPermissions.and.returnValue(of(mockPermissions));
+
+      const profileWithoutPermissions: UserProfile = {
+        ...mockUserProfile,
+        permissions: null
+      };
+      mockUserProfileService.getUserProfile.and.returnValue(of(profileWithoutPermissions));
+
+      fixture = TestBed.createComponent(NavBarComponent);
+      component = fixture.componentInstance;
+      fixture.detectChanges();
+
+      expect(mockPermissionsService.getMyPermissions).toHaveBeenCalled();
+    });
+  });
 });
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.ts b/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.ts
index af85a2e9364..8227bf6e848 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.ts
+++ b/src/dotnet/APIView/ClientSPA/src/app/_components/shared/nav-bar/nav-bar.component.ts
@@ -1,5 +1,5 @@
 import { Component, OnInit } from '@angular/core';
-import { ActivatedRoute } from '@angular/router';
+import { ActivatedRoute, RouterModule } from '@angular/router';
 import { HttpClient } from '@angular/common/http';
 import { CommonModule } from '@angular/common';
 import { FormsModule } from '@angular/forms';
@@ -15,6 +15,7 @@ import { AuthService } from 'src/app/_services/auth/auth.service';
 import { ConfigService } from 'src/app/_services/config/config.service';
 import { NotificationsService } from 'src/app/_services/notifications/notifications.service';
 import { UserProfileService } from 'src/app/_services/user-profile/user-profile.service';
+import { PermissionsService } from 'src/app/_services/permissions/permissions.service';
 import { environment } from 'src/environments/environment';
 
 @Component({
@@ -25,6 +26,7 @@ import { environment } from 'src/environments/environment';
     imports: [
         CommonModule,
         FormsModule,
+        RouterModule,
         DrawerModule,
         SelectButtonModule,
         TimeagoModule
@@ -45,6 +47,7 @@ export class NavBarComponent implements OnInit {
   isLoggedIn: boolean = false;
   reviewId: string | null = null;
   isApprover: boolean = false;
+  isAdmin: boolean = false;
 
   // Theme options
   themes : SelectItemModel[] = [
@@ -56,7 +59,7 @@ export class NavBarComponent implements OnInit {
 
   constructor(private userProfileService: UserProfileService, private configService: ConfigService,
     private notificationsService: NotificationsService, private authService: AuthService, private route: ActivatedRoute,
-    private http: HttpClient
+    private http: HttpClient, private permissionsService: PermissionsService
   ) { }
 
   ngOnInit(): void {
@@ -71,6 +74,7 @@ export class NavBarComponent implements OnInit {
       this.userProfile = userProfile;
       if (isLoggedIn && userProfile) {
         this.checkApproverStatus();
+        this.checkAdminStatus(userProfile);
         // Initialize theme selection from user preferences
         const currentTheme = this.themes.find(t => t.data === userProfile.preferences.theme);
         if (currentTheme) {
@@ -128,6 +132,21 @@ export class NavBarComponent implements OnInit {
     });
   }
 
+  private checkAdminStatus(userProfile: UserProfile) {
+    if (userProfile.permissions) {
+      this.isAdmin = this.permissionsService.isAdmin(userProfile.permissions);
+    } else {
+      this.permissionsService.getMyPermissions().subscribe({
+        next: (permissions) => {
+          this.isAdmin = this.permissionsService.isAdmin(permissions);
+        },
+        error: () => {
+          this.isAdmin = false;
+        }
+      });
+    }
+  }
+
   changeTheme(theme: SelectItemModel) {
     this.selectedTheme = theme;
     if (this.userProfile) {
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_helpers/router-helpers.ts b/src/dotnet/APIView/ClientSPA/src/app/_helpers/router-helpers.ts
index a269c1108c5..0366643a8bc 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/_helpers/router-helpers.ts
+++ b/src/dotnet/APIView/ClientSPA/src/app/_helpers/router-helpers.ts
@@ -14,6 +14,7 @@ export const CONVERSATION_PAGE_NAME = "Conversation";
 export const REVISION_PAGE_NAME = "Revision";
 export const SAMPLES_PAGE_NAME = "Samples";
 export const PROFILE_PAGE_NAME = "Your Profile";
+export const ADMIN_PERMISSIONS_PAGE_NAME = "Admin Permissions";
 
 export function getQueryParams(route: ActivatedRoute, excludedKeys: string[] = [SCROLL_TO_NODE_QUERY_PARAM]) {
   return route.snapshot.queryParamMap.keys.reduce((params: { [key: string]: any; }, key) => {
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_models/permissions.ts b/src/dotnet/APIView/ClientSPA/src/app/_models/permissions.ts
new file mode 100644
index 00000000000..46e4a9006a9
--- /dev/null
+++ b/src/dotnet/APIView/ClientSPA/src/app/_models/permissions.ts
@@ -0,0 +1,123 @@
+/**
+ * Global roles that apply to all languages
+ * Note: Values must be camelCase to match backend JSON serialization
+ */
+export enum GlobalRole {
+    Unknown = 'unknown',
+    ServiceTeam = 'serviceTeam',
+    SdkTeam = 'sdkTeam',
+    Admin = 'admin'
+}
+
+/**
+ * Language-scoped roles that must be assigned to a specific language
+ * Note: Values must be camelCase to match backend JSON serialization
+ */
+export enum LanguageScopedRole {
+    DeputyArchitect = 'deputyArchitect',
+    Architect = 'architect'
+}
+
+/**
+ * Base interface for role assignments (discriminated union)
+ */
+export interface GlobalRoleAssignment {
+    kind: 'global';
+    role: GlobalRole;
+}
+
+export interface LanguageScopedRoleAssignment {
+    kind: 'scoped';
+    role: LanguageScopedRole;
+    language: string;
+}
+
+/**
+ * A role assignment can be either global or language-scoped
+ */
+export type RoleAssignment = GlobalRoleAssignment | LanguageScopedRoleAssignment;
+
+/**
+ * Group-based permission assignment stored in Cosmos DB
+ */
+export interface GroupPermissions {
+    id: string;
+    type: 'group';
+    groupId: string;
+    groupName: string;
+    roles: RoleAssignment[];
+    members: string[];
+    lastUpdatedOn: string;
+    lastUpdatedBy: string;
+    serviceNames: string[];
+}
+
+/**
+ * Computed effective permissions (direct + group-inherited)
+ */
+export interface EffectivePermissions {
+    userId: string;
+    roles: RoleAssignment[];
+}
+
+/**
+ * Request model for creating or updating a group
+ */
+export interface GroupPermissionsRequest {
+    groupId: string;
+    groupName: string;
+    roles: RoleAssignment[];
+    serviceNames: string[];
+}
+
+/**
+ * Request model for adding members to a group
+ */
+export interface AddMembersRequest {
+    userIds: string[];
+}
+
+/**
+ * Result model for adding members to a group
+ */
+export interface AddMembersResult {
+    addedUsers: string[];
+    invalidUsers: string[];
+    allUsersValid: boolean;
+}
+
+export const ROLE_DISPLAY_NAMES: { [key: string]: string } = {
+    [GlobalRole.Admin]: 'Admin',
+    [GlobalRole.ServiceTeam]: 'Service Team',
+    [GlobalRole.SdkTeam]: 'SDK Team',
+    [GlobalRole.Unknown]: 'Unknown',
+    [LanguageScopedRole.Architect]: 'Architect',
+    [LanguageScopedRole.DeputyArchitect]: 'Deputy Architect'
+};
+
+export const SUPPORTED_LANGUAGES = [
+    { label: 'C', value: 'C' },
+    { label: 'C++', value: 'C++' },
+    { label: 'C#', value: 'C#' },
+    { label: 'Go', value: 'Go' },
+    { label: 'Java', value: 'Java' },
+    { label: 'JavaScript', value: 'JavaScript' },
+    { label: 'Python', value: 'Python' },
+    { label: 'Swift', value: 'Swift' },
+    { label: 'TypeSpec', value: 'TypeSpec' }
+];
+
+export const GLOBAL_ROLE_OPTIONS = [
+    { label: ROLE_DISPLAY_NAMES[GlobalRole.ServiceTeam], value: GlobalRole.ServiceTeam },
+    { label: ROLE_DISPLAY_NAMES[GlobalRole.SdkTeam], value: GlobalRole.SdkTeam },
+    { label: ROLE_DISPLAY_NAMES[GlobalRole.Admin], value: GlobalRole.Admin }
+];
+
+export const LANGUAGE_SCOPED_ROLE_OPTIONS = [
+    { label: ROLE_DISPLAY_NAMES[LanguageScopedRole.DeputyArchitect], value: LanguageScopedRole.DeputyArchitect },
+    { label: ROLE_DISPLAY_NAMES[LanguageScopedRole.Architect], value: LanguageScopedRole.Architect }
+];
+
+export function formatRoleName(role: string): string {
+    return ROLE_DISPLAY_NAMES[role] || role;
+}
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_models/userProfile.ts b/src/dotnet/APIView/ClientSPA/src/app/_models/userProfile.ts
index 8252521c7fc..c9579472996 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/_models/userProfile.ts
+++ b/src/dotnet/APIView/ClientSPA/src/app/_models/userProfile.ts
@@ -1,15 +1,18 @@
 import { UserPreferenceModel } from "./userPreferenceModel";
+import { EffectivePermissions } from "./permissions";
 
 export class UserProfile {
     userName: string
     email: string
     languages: string[]
     preferences : UserPreferenceModel
+    permissions: EffectivePermissions | null
 
     constructor() {
         this.userName = '';
         this.email = '';
         this.languages = [];
         this.preferences = new UserPreferenceModel();
+        this.permissions = null;
     }
 }
\ No newline at end of file
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_modules/shared/shared-app.module.ts b/src/dotnet/APIView/ClientSPA/src/app/_modules/shared/shared-app.module.ts
index f07efc4b42b..300cd96fd5b 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/_modules/shared/shared-app.module.ts
+++ b/src/dotnet/APIView/ClientSPA/src/app/_modules/shared/shared-app.module.ts
@@ -1,5 +1,6 @@
 import { NgModule } from '@angular/core';
 import { CommonModule } from '@angular/common';
+import { RouterModule } from '@angular/router';
 import { NavBarComponent } from 'src/app/_components/shared/nav-bar/nav-bar.component';
 import { LanguageNamesPipe } from 'src/app/_pipes/language-names.pipe';
 import { LastUpdatedOnPipe } from 'src/app/_pipes/last-updated-on.pipe';
@@ -63,6 +64,7 @@ const monacoEditorConfig: NgxMonacoEditorConfig = {
   ],
   imports: [
     CommonModule,
+    RouterModule,
     BadgeModule,
     ContextMenuModule,
     TableModule,
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_services/permissions/permissions.service.spec.ts b/src/dotnet/APIView/ClientSPA/src/app/_services/permissions/permissions.service.spec.ts
new file mode 100644
index 00000000000..f68c71cdb3c
--- /dev/null
+++ b/src/dotnet/APIView/ClientSPA/src/app/_services/permissions/permissions.service.spec.ts
@@ -0,0 +1,211 @@
+import { TestBed } from '@angular/core/testing';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { PermissionsService } from './permissions.service';
+import { ConfigService } from '../config/config.service';
+import { EffectivePermissions, GlobalRole, LanguageScopedRole } from 'src/app/_models/permissions';
+
+describe('PermissionsService', () => {
+    let service: PermissionsService;
+    let configServiceSpy: jasmine.SpyObj<ConfigService>;
+
+    beforeEach(() => {
+        const spy = jasmine.createSpyObj('ConfigService', [], { apiUrl: 'http://localhost/' });
+
+        TestBed.configureTestingModule({
+            imports: [HttpClientTestingModule],
+            providers: [
+                PermissionsService,
+                { provide: ConfigService, useValue: spy }
+            ]
+        });
+
+        service = TestBed.inject(PermissionsService);
+        configServiceSpy = TestBed.inject(ConfigService) as jasmine.SpyObj<ConfigService>;
+    });
+
+    it('should be created', () => {
+        expect(service).toBeTruthy();
+    });
+
+    describe('hasGlobalRole', () => {
+        it('should return false for null permissions', () => {
+            expect(service.hasGlobalRole(null, GlobalRole.Admin)).toBeFalse();
+        });
+
+        it('should return false for undefined permissions', () => {
+            expect(service.hasGlobalRole(undefined, GlobalRole.Admin)).toBeFalse();
+        });
+
+        it('should return true when user has the specified global role', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.Admin }]
+            };
+            expect(service.hasGlobalRole(permissions, GlobalRole.Admin)).toBeTrue();
+        });
+
+        it('should return false when user does not have the specified global role', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.SdkTeam }]
+            };
+            expect(service.hasGlobalRole(permissions, GlobalRole.Admin)).toBeFalse();
+        });
+
+        it('should return true when user has any of the specified global roles', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.SdkTeam }]
+            };
+            expect(service.hasGlobalRole(permissions, [GlobalRole.Admin, GlobalRole.SdkTeam])).toBeTrue();
+        });
+    });
+
+    describe('hasLanguageRole', () => {
+        it('should return false for null permissions', () => {
+            expect(service.hasLanguageRole(null, LanguageScopedRole.Architect, 'Python')).toBeFalse();
+        });
+
+        it('should return true when user has the specified language role for the correct language', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'scoped', role: LanguageScopedRole.Architect, language: 'Python' }]
+            };
+            expect(service.hasLanguageRole(permissions, LanguageScopedRole.Architect, 'Python')).toBeTrue();
+        });
+
+        it('should return false when user has the role for a different language', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'scoped', role: LanguageScopedRole.Architect, language: 'Python' }]
+            };
+            expect(service.hasLanguageRole(permissions, LanguageScopedRole.Architect, 'Java')).toBeFalse();
+        });
+
+        it('should be case-insensitive for language matching', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'scoped', role: LanguageScopedRole.Architect, language: 'Python' }]
+            };
+            expect(service.hasLanguageRole(permissions, LanguageScopedRole.Architect, 'python')).toBeTrue();
+        });
+    });
+
+    describe('canApprove', () => {
+        it('should return true for Admin regardless of language', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.Admin }]
+            };
+            expect(service.canApprove(permissions, 'AnyLanguage')).toBeTrue();
+        });
+
+        it('should return true for Architect with matching language', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'scoped', role: LanguageScopedRole.Architect, language: 'Python' }]
+            };
+            expect(service.canApprove(permissions, 'Python')).toBeTrue();
+        });
+
+        it('should return true for DeputyArchitect with matching language', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'scoped', role: LanguageScopedRole.DeputyArchitect, language: 'Java' }]
+            };
+            expect(service.canApprove(permissions, 'Java')).toBeTrue();
+        });
+
+        it('should return false for Architect with non-matching language', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'scoped', role: LanguageScopedRole.Architect, language: 'Python' }]
+            };
+            expect(service.canApprove(permissions, 'Java')).toBeFalse();
+        });
+
+        it('should return false for SdkTeam without architect role', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.SdkTeam }]
+            };
+            expect(service.canApprove(permissions, 'Python')).toBeFalse();
+        });
+    });
+
+    describe('isAdmin', () => {
+        it('should return true for Admin', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.Admin }]
+            };
+            expect(service.isAdmin(permissions)).toBeTrue();
+        });
+
+        it('should return false for non-Admin', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.SdkTeam }]
+            };
+            expect(service.isAdmin(permissions)).toBeFalse();
+        });
+    });
+
+    describe('hasElevatedAccess', () => {
+        it('should return true for Admin', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.Admin }]
+            };
+            expect(service.hasElevatedAccess(permissions)).toBeTrue();
+        });
+
+        it('should return true for SdkTeam', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.SdkTeam }]
+            };
+            expect(service.hasElevatedAccess(permissions)).toBeTrue();
+        });
+
+        it('should return false for ServiceTeam', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.ServiceTeam }]
+            };
+            expect(service.hasElevatedAccess(permissions)).toBeFalse();
+        });
+    });
+
+    describe('getApprovalLanguages', () => {
+        it('should return ["*"] for Admin', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.Admin }]
+            };
+            expect(service.getApprovalLanguages(permissions)).toEqual(['*']);
+        });
+
+        it('should return list of languages for Architect roles', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [
+                    { kind: 'scoped', role: LanguageScopedRole.Architect, language: 'Python' },
+                    { kind: 'scoped', role: LanguageScopedRole.DeputyArchitect, language: 'Java' }
+                ]
+            };
+            const languages = service.getApprovalLanguages(permissions);
+            expect(languages).toContain('Python');
+            expect(languages).toContain('Java');
+            expect(languages.length).toBe(2);
+        });
+
+        it('should return empty array for no approval roles', () => {
+            const permissions: EffectivePermissions = {
+                userId: 'testuser',
+                roles: [{ kind: 'global', role: GlobalRole.SdkTeam }]
+            };
+            expect(service.getApprovalLanguages(permissions)).toEqual([]);
+        });
+    });
+});
diff --git a/src/dotnet/APIView/ClientSPA/src/app/_services/permissions/permissions.service.ts b/src/dotnet/APIView/ClientSPA/src/app/_services/permissions/permissions.service.ts
new file mode 100644
index 00000000000..cfba0b44b68
--- /dev/null
+++ b/src/dotnet/APIView/ClientSPA/src/app/_services/permissions/permissions.service.ts
@@ -0,0 +1,151 @@
+import { Injectable } from '@angular/core';
+import { Observable } from 'rxjs';
+import { HttpClient } from '@angular/common/http';
+import { ConfigService } from '../config/config.service';
+import { 
+    EffectivePermissions, 
+    GlobalRole, 
+    LanguageScopedRole, 
+    GroupPermissions,
+    GroupPermissionsRequest,
+    AddMembersRequest,
+    AddMembersResult
+} from 'src/app/_models/permissions';
+
+@Injectable({
+    providedIn: 'root'
+})
+export class PermissionsService {
+    private baseUrl: string = this.configService.apiUrl + 'permissions';
+
+    constructor(
+        private http: HttpClient,
+        private configService: ConfigService
+    ) { }
+
+    getMyPermissions(): Observable<EffectivePermissions> {
+        return this.http.get<EffectivePermissions>(`${this.baseUrl}/me`, { withCredentials: true });
+    }
+
+    /**
+     * Get all permission groups (Admin only)
+     */
+    getAllGroups(): Observable<GroupPermissions[]> {
+        return this.http.get<GroupPermissions[]>(`${this.baseUrl}/groups`, { withCredentials: true });
+    }
+
+    /**
+     * Get a specific group by ID (Admin only)
+     */
+    getGroup(groupId: string): Observable<GroupPermissions> {
+        return this.http.get<GroupPermissions>(`${this.baseUrl}/groups/${groupId}`, { withCredentials: true });
+    }
+
+    /**
+     * Create a new permission group (Admin only)
+     */
+    createGroup(request: GroupPermissionsRequest): Observable<GroupPermissions> {
+        return this.http.post<GroupPermissions>(`${this.baseUrl}/groups`, request, { withCredentials: true });
+    }
+
+    /**
+     * Update an existing permission group (Admin only)
+     */
+    updateGroup(groupId: string, request: GroupPermissionsRequest): Observable<GroupPermissions> {
+        return this.http.put<GroupPermissions>(`${this.baseUrl}/groups/${groupId}`, request, { withCredentials: true });
+    }
+
+    /**
+     * Delete a permission group (Admin only)
+     */
+    deleteGroup(groupId: string): Observable<void> {
+        return this.http.delete<void>(`${this.baseUrl}/groups/${groupId}`, { withCredentials: true });
+    }
+
+    /**
+     * Add members to a group (Admin only)
+     */
+    addMembersToGroup(groupId: string, userIds: string[]): Observable<AddMembersResult> {
+        const request: AddMembersRequest = { userIds };
+        return this.http.post<AddMembersResult>(`${this.baseUrl}/groups/${groupId}/members`, request, { withCredentials: true });
+    }
+
+    /**
+     * Remove a member from a group (Admin only)
+     */
+    removeMemberFromGroup(groupId: string, userId: string): Observable<void> {
+        return this.http.delete<void>(`${this.baseUrl}/groups/${groupId}/members/${userId}`, { withCredentials: true });
+    }
+
+    /**
+     * Get all usernames for autocomplete (Admin only)
+     * This loads all users once - filtering is done client-side
+     */
+    getAllUsernames(): Observable<string[]> {
+        return this.http.get<string[]>(`${this.baseUrl}/users`, { withCredentials: true });
+    }
+
+    hasGlobalRole(permissions: EffectivePermissions | null | undefined, roles: GlobalRole | GlobalRole[]): boolean {
+        if (!permissions || !permissions.roles) {
+            return false;
+        }
+        const roleArray = Array.isArray(roles) ? roles : [roles];
+        return permissions.roles.some(r =>
+            r.kind === 'global' && roleArray.includes(r.role as GlobalRole)
+        );
+    }
+
+    hasLanguageRole(
+        permissions: EffectivePermissions | null | undefined, 
+        roles: LanguageScopedRole | LanguageScopedRole[], 
+        language: string
+    ): boolean {
+        if (!permissions || !permissions.roles) {
+            return false;
+        }
+        const roleArray = Array.isArray(roles) ? roles : [roles];
+        return permissions.roles.some(r =>
+            r.kind === 'scoped' && 
+            roleArray.includes(r.role as LanguageScopedRole) && 
+            r.language.toLowerCase() === language.toLowerCase()
+        );
+    }
+
+    canApprove(permissions: EffectivePermissions | null | undefined, language: string): boolean {
+        return this.hasGlobalRole(permissions, GlobalRole.Admin) ||
+            this.hasLanguageRole(permissions, [LanguageScopedRole.Architect, LanguageScopedRole.DeputyArchitect], language);
+    }
+
+    isAdmin(permissions: EffectivePermissions | null | undefined): boolean {
+        return this.hasGlobalRole(permissions, GlobalRole.Admin);
+    }
+
+    hasElevatedAccess(permissions: EffectivePermissions | null | undefined): boolean {
+        return this.hasGlobalRole(permissions, [GlobalRole.SdkTeam, GlobalRole.Admin]);
+    }
+
+    isTeamMember(permissions: EffectivePermissions | null | undefined): boolean {
+        return this.hasGlobalRole(permissions, [GlobalRole.ServiceTeam, GlobalRole.SdkTeam, GlobalRole.Admin]);
+    }
+
+    getApprovalLanguages(permissions: EffectivePermissions | null | undefined): string[] {
+        if (!permissions || !permissions.roles) {
+            return [];
+        }
+
+        // If user is Admin, they can approve for all languages (return empty to indicate "all")
+        if (this.isAdmin(permissions)) {
+            return ['*']; // Special marker for "all languages"
+        }
+
+        // Get all languages from Architect and DeputyArchitect roles
+        const languages = new Set<string>();
+        for (const role of permissions.roles) {
+            if (role.kind === 'scoped' && 
+                (role.role === LanguageScopedRole.Architect || role.role === LanguageScopedRole.DeputyArchitect)) {
+                languages.add(role.language);
+            }
+        }
+        return Array.from(languages);
+    }
+}
diff --git a/src/dotnet/APIView/ClientSPA/src/app/app-routing.module.ts b/src/dotnet/APIView/ClientSPA/src/app/app-routing.module.ts
index b05bd9a24ef..9e98aa7603d 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/app-routing.module.ts
+++ b/src/dotnet/APIView/ClientSPA/src/app/app-routing.module.ts
@@ -3,8 +3,9 @@ import { RouterModule, Routes } from '@angular/router';
 
 import { IndexPageComponent } from './_components/index-page/index-page.component';
 import { AuthGuard } from './_guards/auth.guard';
-import { CONVERSATION_PAGE_NAME, INDEX_PAGE_NAME, PROFILE_PAGE_NAME, REVIEW_PAGE_NAME, REVISION_PAGE_NAME, SAMPLES_PAGE_NAME } from './_helpers/router-helpers';
+import { ADMIN_PERMISSIONS_PAGE_NAME, CONVERSATION_PAGE_NAME, INDEX_PAGE_NAME, PROFILE_PAGE_NAME, REVIEW_PAGE_NAME, REVISION_PAGE_NAME, SAMPLES_PAGE_NAME } from './_helpers/router-helpers';
 import { ProfilePageComponent } from './_components/profile-page/profile-page.component';
+import { AdminPermissionsPageComponent } from './_components/admin-permissions-page/admin-permissions-page.component';
 
 const routes: Routes = [
   { path: '', component: IndexPageComponent, canActivate: [AuthGuard], data: { pageName: INDEX_PAGE_NAME } },
@@ -16,7 +17,8 @@ const routes: Routes = [
       { path: 'conversation/:reviewId', loadChildren: () => import('./_modules/conversation-page.module').then(m => m.ConversationPageModule), data: { pageName: CONVERSATION_PAGE_NAME} },
       { path: 'revision/:reviewId', loadChildren: () => import('./_modules/revision-page.module').then(m => m.RevisionPageModule), data: { pageName: REVISION_PAGE_NAME }  },
       { path: 'samples/:reviewId', loadChildren: () => import('./_modules/samples-page.module').then(m => m.SamplesPageModule), data: { pageName: SAMPLES_PAGE_NAME } },
-      { path: 'profile/:userName', component: ProfilePageComponent, data: { pageName: PROFILE_PAGE_NAME }}
+      { path: 'profile/:userName', component: ProfilePageComponent, data: { pageName: PROFILE_PAGE_NAME }},
+      { path: 'admin/permissions', component: AdminPermissionsPageComponent, data: { pageName: ADMIN_PERMISSIONS_PAGE_NAME }}
      ]
   },
   { path: '**', component: IndexPageComponent, pathMatch: 'full' }
diff --git a/src/dotnet/APIView/ClientSPA/src/app/app.module.ts b/src/dotnet/APIView/ClientSPA/src/app/app.module.ts
index 906555a1459..98d5edf377a 100644
--- a/src/dotnet/APIView/ClientSPA/src/app/app.module.ts
+++ b/src/dotnet/APIView/ClientSPA/src/app/app.module.ts
@@ -2,6 +2,7 @@ import { NgModule, inject, provideAppInitializer } from '@angular/core';
 import { BrowserModule } from '@angular/platform-browser';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
 import { HTTP_INTERCEPTORS, HttpClientModule } from '@angular/common/http';
+import { FormsModule } from '@angular/forms';
 
 import { AppRoutingModule } from './app-routing.module';
 import { AppComponent } from './app.component';
@@ -10,14 +11,23 @@ import { ReviewsListComponent } from './_components/reviews-list/reviews-list.co
 import { ToastModule } from 'primeng/toast';
 import { ToolbarModule } from 'primeng/toolbar';
 import { BadgeModule } from 'primeng/badge';
+import { DialogModule } from 'primeng/dialog';
+import { SelectButtonModule } from 'primeng/selectbutton';
+import { SelectModule } from 'primeng/select';
+import { InputTextModule } from 'primeng/inputtext';
+import { ButtonModule } from 'primeng/button';
+import { TooltipModule } from 'primeng/tooltip';
+import { ConfirmDialogModule } from 'primeng/confirmdialog';
+import { AutoCompleteModule } from 'primeng/autocomplete';
 import { Observable } from 'rxjs';
 import { ConfigService } from './_services/config/config.service';
 import { CookieService } from 'ngx-cookie-service';
 import { SharedAppModule } from './_modules/shared/shared-app.module';
 import { HttpErrorInterceptorService } from './_services/http-error-interceptor/http-error-interceptor.service';
-import { MessageService } from 'primeng/api';
 import { APP_BASE_HREF, CommonModule } from '@angular/common';
+import { ConfirmationService, MessageService } from 'primeng/api';
 import { ProfilePageComponent } from './_components/profile-page/profile-page.component';
+import { AdminPermissionsPageComponent } from './_components/admin-permissions-page/admin-permissions-page.component';
 import { providePrimeNG } from 'primeng/config';
 import Lara from '@primeuix/themes/lara';
 
@@ -32,7 +42,8 @@ export function initializeApp(configService: ConfigService) {
     AppComponent,
     IndexPageComponent,
     ReviewsListComponent,
-    ProfilePageComponent
+    ProfilePageComponent,
+    AdminPermissionsPageComponent
   ],
   imports: [
     SharedAppModule,
@@ -43,7 +54,16 @@ export function initializeApp(configService: ConfigService) {
     NoopAnimationsModule,  // Disabled animations to prevent continuous change detection
     ToolbarModule,
     ToastModule,
-    HttpClientModule
+    HttpClientModule,
+    FormsModule,
+    DialogModule,
+    SelectButtonModule,
+    SelectModule,
+    InputTextModule,
+    ButtonModule,
+    TooltipModule,
+    ConfirmDialogModule,
+    AutoCompleteModule
   ],
   providers: [
     ConfigService,
@@ -58,6 +78,7 @@ export function initializeApp(configService: ConfigService) {
     },
     { provide: APP_BASE_HREF, useValue: '/' },
     MessageService,
+    ConfirmationService,
     CookieService,
     providePrimeNG({
       theme: {
diff --git a/tools/apiview/parsers/apiview-treestyle-parser-schema/permissions.tsp b/tools/apiview/parsers/apiview-treestyle-parser-schema/permissions.tsp
new file mode 100644
index 00000000000..bedfc1b5bc1
--- /dev/null
+++ b/tools/apiview/parsers/apiview-treestyle-parser-schema/permissions.tsp
@@ -0,0 +1,72 @@
+namespace ApiView;
+
+/** Roles that apply globally to all languages */
+enum GlobalRole {
+    /** Default value */
+    Unknown,
+    /** Service team members who create and manage reviews */
+    ServiceTeam,
+    /** SDK team members with additional privileges */
+    SdkTeam,
+    /** Admin with full system permissions */
+    Admin
+}
+
+/** Roles that must be scoped to a specific language */
+enum LanguageScopedRole {
+    /** Deputy architect with architect-like permissions for a specific language */
+    DeputyArchitect,
+    /** Architect with elevated API review permissions for a specific language */
+    Architect
+}
+
+/** Assignment for global roles - applies to all languages */
+model GlobalRoleAssignment {
+    /** Discriminator for role assignment type */
+    kind: "global";
+    /** The global role being assigned */
+    role: GlobalRole;
+}
+
+/** Assignment for language-scoped roles - requires a specific language */
+model LanguageScopedRoleAssignment {
+    /** Discriminator for role assignment type */
+    kind: "scoped";
+    /** The language-scoped role being assigned */
+    role: LanguageScopedRole;
+    /** The specific language this role applies to (required) */
+    language: string;
+}
+
+/** A role assignment can be either global or language-scoped */
+alias RoleAssignment = GlobalRoleAssignment | LanguageScopedRoleAssignment;
+
+/** Group-based permission assignment stored in Cosmos DB */
+model GroupPermissions {
+    /** Document ID (format: "group-{groupId}") */
+    id: string;
+    /** Document type discriminator */
+    type: "group";
+    /** Unique identifier for the group */
+    groupId: string;
+    /** Display name for the group */
+    groupName: string;
+    /** List of role assignments for this group */
+    roles: Array<RoleAssignment>;
+    /** List of user IDs that belong to this group */
+    members: Array<string>;
+    /** Timestamp when group was last updated */
+    lastUpdatedOn: utcDateTime;
+    /** Who last updated this group */
+    lastUpdatedBy: string;
+    /** List of service names associated with this group */
+    serviceNames: Array<string>;
+}
+
+/** Computed effective permissions (direct + group-inherited) */
+model EffectivePermissions {
+    /** GitHub username */
+    userId: string;
+    /** Merged roles from direct assignments and group memberships */
+    roles: Array<RoleAssignment>;
+}